diff mbox series

[FFmpeg-devel,3/9] avformat/smacker: Check audio frame size

Message ID 20200624134705.14833-3-andreas.rheinhardt@gmail.com
State Accepted
Commit 2f687bc83e87cd289fafcebd026fe7f586f86332
Headers show
Series [FFmpeg-devel,1/9] avformat/smacker: Don't increase packet counter prematurely | expand

Checks

Context Check Description
andriy/default pending
andriy/make success Make finished
andriy/make_fate success Make fate finished

Commit Message

Andreas Rheinhardt June 24, 2020, 1:46 p.m. UTC 
The first four bytes of smacker audio are supposed to contain the number
of samples, so treat audio frames smaller than that as invalid.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
---
 libavformat/smacker.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)
diff mbox series

Patch

diff --git a/libavformat/smacker.c b/libavformat/smacker.c
index 787c5d8972..c803ecbec9 100644
--- a/libavformat/smacker.c
+++ b/libavformat/smacker.c
@@ -307,14 +307,14 @@  static int smacker_read_packet(AVFormatContext *s, AVPacket *pkt)
             if(flags & 1) {
                 uint32_t size;
 
-                size = avio_rl32(s->pb) - 4;
-                if (!size || size + 4LL > frame_size) {
+                size = avio_rl32(s->pb);
+                if ((int)size < 8 || size > frame_size) {
                     av_log(s, AV_LOG_ERROR, "Invalid audio part size\n");
                     ret = AVERROR_INVALIDDATA;
                     goto next_frame;
                 }
                 frame_size -= size;
-                frame_size -= 4;
+                size       -= 4;
                 if ((ret = av_reallocp(&smk->bufs[smk->curstream], size)) < 0) {
                     smk->buf_sizes[smk->curstream] = 0;
                     goto next_frame;