The first four bytes of smacker audio are supposed to contain the number
of samples, so treat audio frames smaller than that as invalid.
Signed-off-by: Andreas Rheinhardt <andreas.rheinha...@gmail.com>
---
libavformat/smacker.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/libavformat/smacker.c b/libavformat/smacker.c
index 787c5d8972..c803ecbec9 100644
--- a/libavformat/smacker.c
+++ b/libavformat/smacker.c
@@ -307,14 +307,14 @@ static int smacker_read_packet(AVFormatContext *s,
AVPacket *pkt)
if(flags & 1) {
uint32_t size;
- size = avio_rl32(s->pb) - 4;
- if (!size || size + 4LL > frame_size) {
+ size = avio_rl32(s->pb);
+ if ((int)size < 8 || size > frame_size) {
av_log(s, AV_LOG_ERROR, "Invalid audio part size\n");
ret = AVERROR_INVALIDDATA;
goto next_frame;
}
frame_size -= size;
- frame_size -= 4;
+ size -= 4;
if ((ret = av_reallocp(&smk->bufs[smk->curstream], size)) < 0)
{
smk->buf_sizes[smk->curstream] = 0;
goto next_frame;
--
2.20.1
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
