vlc | branch: master | Rémi Denis-Courmont <[email protected]> | Fri Oct 28 16:15:55 2016 +0300| [5a0122f3df98b4eb3bcd2976acf4eefca1731731] | committer: Rémi Denis-Courmont
voc: fix division by zero If buf[3] == 0xff, i_channels wraps to 0, and i_rate triggers SIGFPE. > http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=5a0122f3df98b4eb3bcd2976acf4eefca1731731 --- modules/demux/voc.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/modules/demux/voc.c b/modules/demux/voc.c index e7dbe22..adaa3b4 100644 --- a/modules/demux/voc.c +++ b/modules/demux/voc.c @@ -309,6 +309,8 @@ static int ReadBlockHeader( demux_t *p_demux ) } new_fmt.i_codec = VLC_CODEC_U8; + if (buf[3] >= 32) + goto corrupt; new_fmt.audio.i_channels = buf[3] + 1; /* can't be nul */ new_fmt.audio.i_rate = 256000000L / ((65536L - GetWLE(buf)) * new_fmt.audio.i_channels); _______________________________________________ vlc-commits mailing list [email protected] https://mailman.videolan.org/listinfo/vlc-commits
