From 74bd17d31648c77d01a0d35b09724715bc40fba2 Mon Sep 17 00:00:00 2001
From: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Date: Fri, 6 Jan 2017 20:31:21 +0100
Subject: [PATCH] epafdec: prevent overflow during block alignment calculation
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
---
libavformat/epafdec.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/libavformat/epafdec.c b/libavformat/epafdec.c
index 29190fff720..0cd9627a4b2 100644
--- a/libavformat/epafdec.c
+++ b/libavformat/epafdec.c
@@ -20,6 +20,7 @@
*/
#include "libavutil/intreadwrite.h"
+#include "libavcodec/internal.h"
#include "avformat.h"
#include "internal.h"
#include "pcm.h"
@@ -59,7 +60,7 @@ static int epaf_read_header(AVFormatContext *s)
channels = avio_rb32(s->pb);
}
- if (!channels || !sample_rate)
+ if (channels <= 0 || channels > FF_SANE_NB_CHANNELS || sample_rate <= 0)
return AVERROR_INVALIDDATA;
st = avformat_new_stream(s, NULL);
--
GitLab