diff mbox

[FFmpeg-devel,3/7] electronicarts: prevent overflow during block alignment calculation

Message ID 2072b18d-c176-8313-8ad8-a6bf077fde95@googlemail.com
State Superseded
Headers show

Commit Message

Andreas Cadhalpun Dec. 16, 2016, 2:33 a.m. UTC 
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
---
 libavformat/electronicarts.c | 1 +
 1 file changed, 1 insertion(+)

Comments

Peter Ross Dec. 16, 2016, 7:39 a.m. UTC | #1 
looks good.

On Fri, Dec 16, 2016 at 03:33:26AM +0100, Andreas Cadhalpun wrote:
> Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
> ---
>  libavformat/electronicarts.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/libavformat/electronicarts.c b/libavformat/electronicarts.c
> index 30eb723..9088fe1 100644
> --- a/libavformat/electronicarts.c
> +++ b/libavformat/electronicarts.c
> @@ -556,6 +556,7 @@ static int ea_read_header(AVFormatContext *s)
>          st->codecpar->codec_tag             = 0;   /* no tag */
>          st->codecpar->channels              = ea->num_channels;
>          st->codecpar->sample_rate           = ea->sample_rate;
> +        FF_BAIL_ON_OVERFLOW(s, ea->bytes > INT_MAX / 8 / 2)
>          st->codecpar->bits_per_coded_sample = ea->bytes * 8;
>          st->codecpar->bit_rate              = (int64_t)st->codecpar->channels *
>                                                st->codecpar->sample_rate *
> -- 
> 2.10.2
> 
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel@ffmpeg.org
> http://ffmpeg.org/mailman/listinfo/ffmpeg-devel
-- Peter
(A907 E02F A6E5 0CD2 34CD 20D2 6760 79C5 AC40 DD6B)
diff mbox

Patch

diff --git a/libavformat/electronicarts.c b/libavformat/electronicarts.c
index 30eb723..9088fe1 100644
--- a/libavformat/electronicarts.c
+++ b/libavformat/electronicarts.c
@@ -556,6 +556,7 @@  static int ea_read_header(AVFormatContext *s)
         st->codecpar->codec_tag             = 0;   /* no tag */
         st->codecpar->channels              = ea->num_channels;
         st->codecpar->sample_rate           = ea->sample_rate;
+        FF_BAIL_ON_OVERFLOW(s, ea->bytes > INT_MAX / 8 / 2)
         st->codecpar->bits_per_coded_sample = ea->bytes * 8;
         st->codecpar->bit_rate              = (int64_t)st->codecpar->channels *
                                               st->codecpar->sample_rate *