From d719981273bc779c7d1e879d88404fd867f93a0e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Martin=20Storsj=C3=B6?= Date: Tue, 3 Sep 2013 13:53:23 +0300 Subject: [PATCH] 4xm: Check that the read track value is non-negative MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-stable@libav.org Signed-off-by: Martin Storsjö --- libavformat/4xm.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavformat/4xm.c b/libavformat/4xm.c index f003c9c25a..7a87c3695a 100644 --- a/libavformat/4xm.c +++ b/libavformat/4xm.c @@ -131,6 +131,8 @@ static int parse_strk(AVFormatContext *s, return AVERROR_INVALIDDATA; track = AV_RL32(buf + 8); + if (track < 0) + return AVERROR_INVALIDDATA; if (track + 1 > fourxm->track_count) { if (av_reallocp_array(&fourxm->tracks, track + 1, sizeof(AudioTrack))) return AVERROR(ENOMEM);