4xm: Check that the read track value is non-negative

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
This commit is contained in:
Martin Storsjö 2013-09-03 13:53:23 +03:00
parent 5bcd3ae5b1
commit d719981273
1 changed files with 2 additions and 0 deletions

View File

@ -131,6 +131,8 @@ static int parse_strk(AVFormatContext *s,
return AVERROR_INVALIDDATA;
track = AV_RL32(buf + 8);
if (track < 0)
return AVERROR_INVALIDDATA;
if (track + 1 > fourxm->track_count) {
if (av_reallocp_array(&fourxm->tracks, track + 1, sizeof(AudioTrack)))
return AVERROR(ENOMEM);