diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2015-12-04 20:48:39 +0300 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2015-12-04 20:54:39 +0300 |
| commit | 689a8674131c3852fc78eff1d7c044850d263e22 (patch) | |
| tree | 0a9c43da767b7cf50b4b6f0731edf8823ab1e87c /libavformat/msf.c | |
| parent | a85b02dcf70f62a6a433a607143f1f78fa5648bb (diff) | |
avformat/msf: Check channels when reading the header
Fixes integer overflow
Fixes: 0c2625f236ced104d402b4a03c0d65c7/asan_generic_274e1ce_5990_9314e7a67c26aecf011b178ade9f217c.avi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavformat/msf.c')
| -rw-r--r-- | libavformat/msf.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavformat/msf.c b/libavformat/msf.c index 1d9c999158..73a5a0157d 100644 --- a/libavformat/msf.c +++ b/libavformat/msf.c @@ -51,7 +51,7 @@ static int msf_read_header(AVFormatContext *s) st->codec->codec_type = AVMEDIA_TYPE_AUDIO; codec = avio_rb32(s->pb); st->codec->channels = avio_rb32(s->pb); - if (st->codec->channels <= 0) + if (st->codec->channels <= 0 || st->codec->channels >= INT_MAX / 1024) return AVERROR_INVALIDDATA; size = avio_rb32(s->pb); st->codec->sample_rate = avio_rb32(s->pb); |