From 1d29624c73fde14a987735b3d4df8d005caebb58 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Mon, 17 Dec 2012 20:51:07 +0100 Subject: [PATCH] oggparsevorbis: check channels Fixes out of array accesses Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer --- libavformat/oggparsevorbis.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/libavformat/oggparsevorbis.c b/libavformat/oggparsevorbis.c index 09f5205fbb..7e8f6cede3 100644 --- a/libavformat/oggparsevorbis.c +++ b/libavformat/oggparsevorbis.c @@ -230,6 +230,7 @@ vorbis_header (AVFormatContext * s, int idx) const uint8_t *p = os->buf + os->pstart + 7; /* skip "\001vorbis" tag */ unsigned blocksize, bs0, bs1; int srate; + int channels; if (os->psize != 30) return -1; @@ -237,7 +238,12 @@ vorbis_header (AVFormatContext * s, int idx) if (bytestream_get_le32(&p) != 0) /* vorbis_version */ return -1; - st->codec->channels = bytestream_get_byte(&p); + channels= bytestream_get_byte(&p); + if (st->codec->channels && channels != st->codec->channels) { + av_log(s, AV_LOG_ERROR, "Channel change is not supported\n"); + return AVERROR_PATCHWELCOME; + } + st->codec->channels = channels; srate = bytestream_get_le32(&p); p += 4; // skip maximum bitrate st->codec->bit_rate = bytestream_get_le32(&p); // nominal bitrate