diff mbox

[FFmpeg-devel,4/9] ircamdec: prevent overflow during block alignment calculation

Message ID de60f15d-1f7c-a0c7-a7ae-b9f8f22f0344@googlemail.com
State Accepted
Headers show

Commit Message

Andreas Cadhalpun Jan. 26, 2017, 1:12 a.m. UTC 
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
---
 libavformat/ircamdec.c | 6 ++++++
 1 file changed, 6 insertions(+)

Comments

Michael Niedermayer Jan. 29, 2017, 1:34 a.m. UTC | #1 
On Thu, Jan 26, 2017 at 02:12:19AM +0100, Andreas Cadhalpun wrote:
> Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
> ---
>  libavformat/ircamdec.c | 6 ++++++
>  1 file changed, 6 insertions(+)

LGTM assuming the author/maintainer does not object, maybe he
prefers this without the log message

[...]
diff mbox

Patch

diff --git a/libavformat/ircamdec.c b/libavformat/ircamdec.c
index 59f3a49411..e3196db84a 100644
--- a/libavformat/ircamdec.c
+++ b/libavformat/ircamdec.c
@@ -20,6 +20,7 @@ 
  */
 
 #include "libavutil/intreadwrite.h"
+#include "libavcodec/internal.h"
 #include "avformat.h"
 #include "internal.h"
 #include "pcm.h"
@@ -87,6 +88,11 @@  static int ircam_read_header(AVFormatContext *s)
 
     st->codecpar->codec_type  = AVMEDIA_TYPE_AUDIO;
     st->codecpar->channels    = channels;
+    if (st->codecpar->channels > FF_SANE_NB_CHANNELS) {
+        av_log(s, AV_LOG_ERROR, "Too many channels %d > %d\n",
+               st->codecpar->channels, FF_SANE_NB_CHANNELS);
+        return AVERROR(ENOSYS);
+    }
     st->codecpar->sample_rate = sample_rate;
 
     st->codecpar->codec_id = ff_codec_get_id(tags, tag);