diff mbox

[FFmpeg-devel] rsd: limit number of channels

Message ID 9cbfa03d-62e4-417d-ba3a-8f52b6a16f7e@googlemail.com
State Accepted
Commit ee5f0f1d355fa0fd9194ac97a2c8598c93ed328b
Headers show

Commit Message

Andreas Cadhalpun Oct. 19, 2016, 9:46 p.m. UTC 
Negative values don't make sense and too large values can cause
overflows. For AV_CODEC_ID_ADPCM_THP this leads to a too small extradata
buffer being allocated, causing out-of-bounds writes.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
---
 libavformat/rsd.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

Comments

Michael Niedermayer Oct. 20, 2016, 12:04 a.m. UTC | #1 
On Wed, Oct 19, 2016 at 11:46:43PM +0200, Andreas Cadhalpun wrote:
> Negative values don't make sense and too large values can cause
> overflows. For AV_CODEC_ID_ADPCM_THP this leads to a too small extradata
> buffer being allocated, causing out-of-bounds writes.
> 
> Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
> ---
>  libavformat/rsd.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)

LGTM

thx

[...]
Andreas Cadhalpun Oct. 20, 2016, 5:56 p.m. UTC | #2 
On 20.10.2016 02:04, Michael Niedermayer wrote:
> On Wed, Oct 19, 2016 at 11:46:43PM +0200, Andreas Cadhalpun wrote:
>> Negative values don't make sense and too large values can cause
>> overflows. For AV_CODEC_ID_ADPCM_THP this leads to a too small extradata
>> buffer being allocated, causing out-of-bounds writes.
>>
>> Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
>> ---
>>  libavformat/rsd.c | 4 +++-
>>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> LGTM

Pushed.

Best regards,
Andreas
diff mbox

Patch

diff --git a/libavformat/rsd.c b/libavformat/rsd.c
index ee6fdfb..5a56e72 100644
--- a/libavformat/rsd.c
+++ b/libavformat/rsd.c
@@ -84,8 +84,10 @@  static int rsd_read_header(AVFormatContext *s)
     }
 
     par->channels = avio_rl32(pb);
-    if (!par->channels)
+    if (par->channels <= 0 || par->channels > INT_MAX / 36) {
+        av_log(s, AV_LOG_ERROR, "Invalid number of channels: %d\n", par->channels);
         return AVERROR_INVALIDDATA;
+    }
 
     avio_skip(pb, 4); // Bit depth
     par->sample_rate = avio_rl32(pb);