diff mbox

[FFmpeg-devel,1/9] 4xm: prevent overflow during block alignment calculation

Message ID fb8e35f8-5cb3-1cc0-b1b8-aad92a0674ce@googlemail.com
State Accepted
Commit e3f13d3a87274d537d319a84e9104f44f84ec3b2
Headers show

Commit Message

Andreas Cadhalpun Jan. 26, 2017, 1:11 a.m. UTC 
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
---
 libavformat/4xm.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

Comments

Michael Niedermayer Jan. 26, 2017, 2:21 a.m. UTC | #1 
On Thu, Jan 26, 2017 at 02:11:02AM +0100, Andreas Cadhalpun wrote:
> Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
> ---
>  libavformat/4xm.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)

LGTM

thx

[...]
Andreas Cadhalpun Jan. 29, 2017, 12:24 a.m. UTC | #2 
On 26.01.2017 03:21, Michael Niedermayer wrote:
> On Thu, Jan 26, 2017 at 02:11:02AM +0100, Andreas Cadhalpun wrote:
>> Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
>> ---
>>  libavformat/4xm.c | 5 ++++-
>>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> LGTM
> 
> thx

Pushed.

Best regards,
Andreas
diff mbox

Patch

diff --git a/libavformat/4xm.c b/libavformat/4xm.c
index 2758b69d29..ead6d2b424 100644
--- a/libavformat/4xm.c
+++ b/libavformat/4xm.c
@@ -29,6 +29,7 @@ 
 
 #include "libavutil/intreadwrite.h"
 #include "libavutil/intfloat.h"
+#include "libavcodec/internal.h"
 #include "avformat.h"
 #include "internal.h"
 
@@ -153,8 +154,10 @@  static int parse_strk(AVFormatContext *s,
     fourxm->tracks[track].audio_pts   = 0;
 
     if (fourxm->tracks[track].channels    <= 0 ||
+        fourxm->tracks[track].channels     > FF_SANE_NB_CHANNELS ||
         fourxm->tracks[track].sample_rate <= 0 ||
-        fourxm->tracks[track].bits        <= 0) {
+        fourxm->tracks[track].bits        <= 0 ||
+        fourxm->tracks[track].bits         > INT_MAX / FF_SANE_NB_CHANNELS) {
         av_log(s, AV_LOG_ERROR, "audio header invalid\n");
         return AVERROR_INVALIDDATA;
     }