Message ID | aec628c8-ef4a-fd07-196a-726188333932@googlemail.com |
---|---|
State | Accepted |
Commit | 9959a52b14bcfa3e5baeb3fc8a86c04bbc0d3d5d |
Headers | show |
On Sun, Oct 16, 2016 at 10:41:32PM +0200, Andreas Cadhalpun wrote: > Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com> > --- > libavformat/astdec.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/libavformat/astdec.c b/libavformat/astdec.c > index f3ca721..7a53d0b 100644 > --- a/libavformat/astdec.c > +++ b/libavformat/astdec.c > @@ -90,7 +90,7 @@ static int ast_read_packet(AVFormatContext *s, AVPacket *pkt) > pos = avio_tell(s->pb); > type = avio_rl32(s->pb); > size = avio_rb32(s->pb); > - if (size > INT_MAX / s->streams[0]->codecpar->channels) > + if (!s->streams[0]->codecpar->channels || size > INT_MAX / s->streams[0]->codecpar->channels) channels seems already checked in ast_read_header() [...]
diff --git a/libavformat/astdec.c b/libavformat/astdec.c index f3ca721..7a53d0b 100644 --- a/libavformat/astdec.c +++ b/libavformat/astdec.c @@ -90,7 +90,7 @@ static int ast_read_packet(AVFormatContext *s, AVPacket *pkt) pos = avio_tell(s->pb); type = avio_rl32(s->pb); size = avio_rb32(s->pb); - if (size > INT_MAX / s->streams[0]->codecpar->channels) + if (!s->streams[0]->codecpar->channels || size > INT_MAX / s->streams[0]->codecpar->channels) return AVERROR_INVALIDDATA; size *= s->streams[0]->codecpar->channels;
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com> --- libavformat/astdec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)