From patchwork Sun Oct 23 16:29:33 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andreas Cadhalpun X-Patchwork-Id: 1145 Delivered-To: ffmpegpatchwork@gmail.com Received: by 10.103.140.133 with SMTP id o127csp1837876vsd; Sun, 23 Oct 2016 09:29:42 -0700 (PDT) X-Received: by 10.28.55.203 with SMTP id e194mr17876159wma.97.1477240182644; Sun, 23 Oct 2016 09:29:42 -0700 (PDT) Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org. [79.124.17.100]) by mx.google.com with ESMTP id w17si12137118wjd.36.2016.10.23.09.29.42; Sun, 23 Oct 2016 09:29:42 -0700 (PDT) Received-SPF: pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) client-ip=79.124.17.100; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@googlemail.com; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org; dmarc=fail (p=QUARANTINE dis=NONE) header.from=googlemail.com Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 765C9689CD9; Sun, 23 Oct 2016 19:29:37 +0300 (EEST) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from mail-wm0-f66.google.com (mail-wm0-f66.google.com [74.125.82.66]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 6250C689CC3 for ; Sun, 23 Oct 2016 19:29:31 +0300 (EEST) Received: by mail-wm0-f66.google.com with SMTP id f193so6285946wmg.3 for ; Sun, 23 Oct 2016 09:29:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=20120113; h=from:subject:to:references:message-id:date:user-agent:mime-version :in-reply-to:content-transfer-encoding; bh=aPzhK3L8413ZDtPqL+hqfZh//RVRZr9lDQ8cat0vytE=; b=WywVnz6L9bZiN2zcbz0/LLZPNWGXOkjMzvdT2fAS8CcNBESpB97RyOG0heTQ2K8Sb6 TawubzhR6qL6XEqbI2GpUG1PdD8GUfOOVj2tVElLIM/P7EBXHUN8MhHAh21teubcWzSA yMNPEorx+RoCPU1uycni+Q4HN89evPkVMDOLZW8xdnIdIdyIoe230S1AJcUu6Dw5wxpx EmlFiwzsK1+BNHWjg5XAQtA7MCmarmlZkGwBJWGCQlhmwJLJDWrQNrbISi2IKb8FSfSF WjnnEkgsoObjLUcxkHu3vQ/kro/S8u2HXOBU7MuCxZjNq+WoeW9S6UXbNLEXxHun1rA8 B0wA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:subject:to:references:message-id:date :user-agent:mime-version:in-reply-to:content-transfer-encoding; bh=aPzhK3L8413ZDtPqL+hqfZh//RVRZr9lDQ8cat0vytE=; b=BVLwmZxZgdQvKqEYZdPe4cXNBWR43NKwVBRPcGSlNM8/g+rvWU8fKnStPLs3ybH/du /C197GZ+f3r2s81g80s0mO0HcJGVAvJGn0R3cb4Q4PJNLJG/tx/Veu02VIs5zSwOAlvv kgJVgS838n8xA//WMD03CDrTjC3QYZVSqpeNLzzLCsIpLtQPLKtuDUd3jtrmxIb3/D6O pllu6c8bhbTvWRySKpcD/A/g33WnWPxxg2egEEp/KIudrCtbbXsbmmvnBk6OISvZDuoi fW595nSsAnrggz3tThpQhNkRHUd2rctG8kHTQFUy+c0tm+XaZtDT2qFrZ4Wpistp+Ou9 6HHA== X-Gm-Message-State: ABUngvfEWlkn8fmasRsYNjNqI2Yof5NFbgsObOi482NLRM8jXk5rHtzQ1LDbEJd8UzVGOQ== X-Received: by 10.194.18.137 with SMTP id w9mr9611624wjd.198.1477240174090; Sun, 23 Oct 2016 09:29:34 -0700 (PDT) Received: from [192.168.2.21] (p5B095E5A.dip0.t-ipconnect.de. [91.9.94.90]) by smtp.googlemail.com with ESMTPSA id ff4sm14486130wjd.39.2016.10.23.09.29.33 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sun, 23 Oct 2016 09:29:33 -0700 (PDT) From: Andreas Cadhalpun X-Google-Original-From: Andreas Cadhalpun To: FFmpeg development discussions and patches References: <6622a3c7-3900-8982-1179-4ccdd0fec2b3@googlemail.com> Message-ID: <2e2d7fb0-ac6c-6555-f286-07a86e0cb9cb@googlemail.com> Date: Sun, 23 Oct 2016 18:29:33 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Icedove/45.4.0 MIME-Version: 1.0 In-Reply-To: <6622a3c7-3900-8982-1179-4ccdd0fec2b3@googlemail.com> Subject: [FFmpeg-devel] [PATCH 07/12] mpeg4audio: validate sample_rate X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" A negative sample rate doesn't make sense and triggers assertions in av_rescale_rnd. Also check for errors from avpriv_mpeg4audio_get_config in ff_mp4_read_dec_config_descr. Signed-off-by: Andreas Cadhalpun --- libavcodec/mpeg4audio.c | 5 +++++ libavformat/isom.c | 6 ++++-- 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/libavcodec/mpeg4audio.c b/libavcodec/mpeg4audio.c index 188d843..01c374f 100644 --- a/libavcodec/mpeg4audio.c +++ b/libavcodec/mpeg4audio.c @@ -42,6 +42,11 @@ static int parse_config_ALS(GetBitContext *gb, MPEG4AudioConfig *c) // which are buggy in old ALS conformance files c->sample_rate = get_bits_long(gb, 32); + if (c->sample_rate <= 0) { + av_log(NULL, AV_LOG_ERROR, "Invalid sample rate %d\n", c->sample_rate); + return AVERROR_INVALIDDATA; + } + // skip number of samples skip_bits_long(gb, 32); diff --git a/libavformat/isom.c b/libavformat/isom.c index cb457dd..88f8605 100644 --- a/libavformat/isom.c +++ b/libavformat/isom.c @@ -508,8 +508,10 @@ int ff_mp4_read_dec_config_descr(AVFormatContext *fc, AVStream *st, AVIOContext return ret; if (st->codecpar->codec_id == AV_CODEC_ID_AAC) { MPEG4AudioConfig cfg = {0}; - avpriv_mpeg4audio_get_config(&cfg, st->codecpar->extradata, - st->codecpar->extradata_size * 8, 1); + ret = avpriv_mpeg4audio_get_config(&cfg, st->codecpar->extradata, + st->codecpar->extradata_size * 8, 1); + if (ret < 0) + return ret; st->codecpar->channels = cfg.channels; if (cfg.object_type == 29 && cfg.sampling_index < 3) // old mp3on4 st->codecpar->sample_rate = avpriv_mpa_freq_tab[cfg.sampling_index];