Message ID | 9cbfa03d-62e4-417d-ba3a-8f52b6a16f7e@googlemail.com |
---|---|
State | Accepted |
Commit | ee5f0f1d355fa0fd9194ac97a2c8598c93ed328b |
Headers | show |
On Wed, Oct 19, 2016 at 11:46:43PM +0200, Andreas Cadhalpun wrote: > Negative values don't make sense and too large values can cause > overflows. For AV_CODEC_ID_ADPCM_THP this leads to a too small extradata > buffer being allocated, causing out-of-bounds writes. > > Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com> > --- > libavformat/rsd.c | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) LGTM thx [...]
On 20.10.2016 02:04, Michael Niedermayer wrote: > On Wed, Oct 19, 2016 at 11:46:43PM +0200, Andreas Cadhalpun wrote: >> Negative values don't make sense and too large values can cause >> overflows. For AV_CODEC_ID_ADPCM_THP this leads to a too small extradata >> buffer being allocated, causing out-of-bounds writes. >> >> Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com> >> --- >> libavformat/rsd.c | 4 +++- >> 1 file changed, 3 insertions(+), 1 deletion(-) > > LGTM Pushed. Best regards, Andreas
diff --git a/libavformat/rsd.c b/libavformat/rsd.c index ee6fdfb..5a56e72 100644 --- a/libavformat/rsd.c +++ b/libavformat/rsd.c @@ -84,8 +84,10 @@ static int rsd_read_header(AVFormatContext *s) } par->channels = avio_rl32(pb); - if (!par->channels) + if (par->channels <= 0 || par->channels > INT_MAX / 36) { + av_log(s, AV_LOG_ERROR, "Invalid number of channels: %d\n", par->channels); return AVERROR_INVALIDDATA; + } avio_skip(pb, 4); // Bit depth par->sample_rate = avio_rl32(pb);
Negative values don't make sense and too large values can cause overflows. For AV_CODEC_ID_ADPCM_THP this leads to a too small extradata buffer being allocated, causing out-of-bounds writes. Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com> --- libavformat/rsd.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)