diff --git a/libavcodec/wavpack.c b/libavcodec/wavpack.c index 75456afe2e..53ba34b69d 100644 --- a/libavcodec/wavpack.c +++ b/libavcodec/wavpack.c @@ -388,6 +388,11 @@ static int wavpack_decode_frame(AVCodecContext *avctx, memset(s->decorr, 0, MAX_TERMS * sizeof(Decorr)); s->samples = LE_32(buf); buf += 4; + /* should not happen but who knows */ + if(s->samples * 2 * avctx->channels > AVCODEC_MAX_AUDIO_FRAME_SIZE){ + av_log(avctx, AV_LOG_ERROR, "Packet size is too big to be handled in lavc!\n"); + return -1; + } s->joint = LE_32(buf) & WV_JOINT; buf += 4; s->CRC = LE_32(buf); buf += 4; // parse metadata blocks diff --git a/libavformat/wv.c b/libavformat/wv.c index 170755c4dd..e601c05fcb 100644 --- a/libavformat/wv.c +++ b/libavformat/wv.c @@ -171,12 +171,6 @@ static int wv_read_packet(AVFormatContext *s, return -1; } - samples = LE_32(wc->extra); - /* should not happen but who knows */ - if(samples * 2 * wc->chan > AVCODEC_MAX_AUDIO_FRAME_SIZE){ - av_log(s, AV_LOG_ERROR, "Packet size is too big to be handled in lavc!\n"); - return -EIO; - } if(av_new_packet(pkt, wc->blksize + WV_EXTRA_SIZE) < 0) return AVERROR_NOMEM; memcpy(pkt->data, wc->extra, WV_EXTRA_SIZE);