Module: libav Branch: release/0.8 Commit: 35c39d2ee2a2ff6f8200b5725dd9bf443dba55c7
Author: Martin Storsjö <[email protected]> Committer: Luca Barbato <[email protected]> Date: Sat Sep 28 23:26:18 2013 +0300 mvi: Add sanity checking for the audio frame size This avoids a division by zero. Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: [email protected] Signed-off-by: Martin Storsjö <[email protected]> (cherry picked from commit 28ff439efd2362fb21e1a78610737f2e26a72d8f) Signed-off-by: Luca Barbato <[email protected]> (cherry picked from commit 04d2f9ace3fb6e880f3488770fc5a39de5b63cbb) --- libavformat/mvi.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/libavformat/mvi.c b/libavformat/mvi.c index 4782aad..51ffb6c 100644 --- a/libavformat/mvi.c +++ b/libavformat/mvi.c @@ -91,6 +91,12 @@ static int read_header(AVFormatContext *s, AVFormatParameters *ap) mvi->get_int = (vst->codec->width * vst->codec->height < (1 << 16)) ? avio_rl16 : avio_rl24; mvi->audio_frame_size = ((uint64_t)mvi->audio_data_size << MVI_FRAC_BITS) / frames_count; + if (mvi->audio_frame_size <= 1 << MVI_FRAC_BITS - 1) { + av_log(s, AV_LOG_ERROR, "Invalid audio_data_size (%d) or frames_count (%d)\n", + mvi->audio_data_size, frames_count); + return AVERROR_INVALIDDATA; + } + mvi->audio_size_counter = (ast->codec->sample_rate * 830 / mvi->audio_frame_size - 1) * mvi->audio_frame_size; mvi->audio_size_left = mvi->audio_data_size; _______________________________________________ libav-commits mailing list [email protected] https://lists.libav.org/mailman/listinfo/libav-commits
