From patchwork Sun Oct 23 16:28:10 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andreas Cadhalpun X-Patchwork-Id: 1143 Delivered-To: ffmpegpatchwork@gmail.com Received: by 10.103.140.133 with SMTP id o127csp1837501vsd; Sun, 23 Oct 2016 09:28:19 -0700 (PDT) X-Received: by 10.28.55.203 with SMTP id e194mr17873029wma.97.1477240099502; Sun, 23 Oct 2016 09:28:19 -0700 (PDT) Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org. [79.124.17.100]) by mx.google.com with ESMTP id xy10si12080633wjb.253.2016.10.23.09.28.18; Sun, 23 Oct 2016 09:28:19 -0700 (PDT) Received-SPF: pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) client-ip=79.124.17.100; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@googlemail.com; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org; dmarc=fail (p=QUARANTINE dis=NONE) header.from=googlemail.com Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 3DEFA689CC0; Sun, 23 Oct 2016 19:28:14 +0300 (EEST) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from mail-wm0-f67.google.com (mail-wm0-f67.google.com [74.125.82.67]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id B0C10689CB1 for ; Sun, 23 Oct 2016 19:28:08 +0300 (EEST) Received: by mail-wm0-f67.google.com with SMTP id d128so6298377wmf.0 for ; Sun, 23 Oct 2016 09:28:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=20120113; h=from:subject:to:references:message-id:date:user-agent:mime-version :in-reply-to:content-transfer-encoding; bh=blt56oTHq+ayiHJxg1E4udBgbpC9FPs1nhREvr2yGV8=; b=Wq/bIjonkmz/p02whgNegIytqjhGyXjJ5jZQV8SWy1GEhwfQsk10Wr38sf466bfIeW kGXAaMh0d8LPhKxrA6a0Er8veXFNRnQrJWnrXaMxhW/6nHHSIIoV9AlHo0syck5RzIG7 1Mnltzp0wTWllFpW3gYGxFnSSzPdjzOYmiYS8sn/x/XvED3puO5Kvk8tcAlpls5fS2Dv T5Y+eTEN3JtYUrC9sUABgRJ3F/ufnwugiHC0b7D350f+TkCn9LkqWsxgJSYplvwi+9yv AaR90+av9evT1s0ZOZVN0NJSCc1OpLdSULJ/+5LuGfp+88NTxXMC+aIZXtrV0+Eq902F qNZg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:subject:to:references:message-id:date :user-agent:mime-version:in-reply-to:content-transfer-encoding; bh=blt56oTHq+ayiHJxg1E4udBgbpC9FPs1nhREvr2yGV8=; b=Ks39LraaEfS/FgqoC+6wEKw1knE6zumJBKeyxPFIwjcfixSr0P1uaduRmcqkV5aGeT ek/dLP2SqlYG5AhdVqbAktIfl1O7ds8uaJZY4pRo1l5+VmJFVTFltBFiSCCZGDxv+dwi 19K+rBc3gvrqG0vjMJ6Srq5S5yfOM1e8JK1xseZNu/oVaKvUzKUzzsYvenqrJWKrL5iA mTY9Ud1qJLQnxyQP6L2zDWJ6tFJUMbwdpGgnHKHRL2wvCBfhMyr9FrH8XZhKhNOI4ZD3 fomZeF8rLxeeCYoXQxjNWhIm/3bbRhGEsmzfaG1kzvF1LFACAlXB6RsjACWlCuwG2KEr C6nA== X-Gm-Message-State: AA6/9RnINPgB2l4lIVpotuZG1gimcbO2b/MYWw87C4RpWteVGMN9w2gwNzVroJBHsX6rNQ== X-Received: by 10.28.187.87 with SMTP id l84mr19004306wmf.60.1477240091394; Sun, 23 Oct 2016 09:28:11 -0700 (PDT) Received: from [192.168.2.21] (p5B095E5A.dip0.t-ipconnect.de. [91.9.94.90]) by smtp.googlemail.com with ESMTPSA id jt8sm14569014wjc.33.2016.10.23.09.28.10 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sun, 23 Oct 2016 09:28:10 -0700 (PDT) From: Andreas Cadhalpun X-Google-Original-From: Andreas Cadhalpun To: FFmpeg development discussions and patches References: <6622a3c7-3900-8982-1179-4ccdd0fec2b3@googlemail.com> Message-ID: <216075de-bf1a-d2cc-aa14-a66014bded22@googlemail.com> Date: Sun, 23 Oct 2016 18:28:10 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Icedove/45.4.0 MIME-Version: 1.0 In-Reply-To: <6622a3c7-3900-8982-1179-4ccdd0fec2b3@googlemail.com> Subject: [FFmpeg-devel] [PATCH 04/12] mov: validate sample_rate X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" A negative sample rate doesn't make sense and triggers assertions in av_rescale_rnd. fate-aac-al07_96 fails if sample_rate == 0 is rejected in ff_mov_read_stsd_entries. Signed-off-by: Andreas Cadhalpun --- libavformat/mov.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/libavformat/mov.c b/libavformat/mov.c index dada1e0..0a3fdd1 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -888,6 +888,10 @@ static int mov_read_ddts(MOVContext *c, AVIOContext *pb, MOVAtom atom) st = c->fc->streams[c->fc->nb_streams-1]; st->codecpar->sample_rate = get_bits_long(&gb, 32); + if (st->codecpar->sample_rate <= 0) { + av_log(c->fc, AV_LOG_ERROR, "Invalid sample rate %d\n", st->codecpar->sample_rate); + return AVERROR_INVALIDDATA; + } skip_bits_long(&gb, 32); /* max bitrate */ st->codecpar->bit_rate = get_bits_long(&gb, 32); st->codecpar->bits_per_coded_sample = get_bits(&gb, 8); @@ -2273,6 +2277,10 @@ int ff_mov_read_stsd_entries(MOVContext *c, AVIOContext *pb, int entries) } else if (st->codecpar->codec_type==AVMEDIA_TYPE_AUDIO) { st->codecpar->codec_id = id; mov_parse_stsd_audio(c, pb, st, sc); + if (st->codecpar->sample_rate < 0) { + av_log(c->fc, AV_LOG_ERROR, "Invalid sample rate %d\n", st->codecpar->sample_rate); + return AVERROR_INVALIDDATA; + } } else if (st->codecpar->codec_type==AVMEDIA_TYPE_SUBTITLE){ st->codecpar->codec_id = id; mov_parse_stsd_subtitle(c, pb, st, sc,