From 8312e3fc9041027a33c8bc667bb99740fdf41dd5 Mon Sep 17 00:00:00 2001 From: Kostya Date: Tue, 15 Mar 2011 09:19:43 +0000 Subject: [PATCH] Do not attempt to decode APE file with no frames This fixes invalid reads/writes with this sample: http://packetstorm.linuxsecurity.com/1103-exploits/vlc105-dos.txt --- libavformat/ape.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libavformat/ape.c b/libavformat/ape.c index 6c269849fd..dd2aeb9ff3 100644 --- a/libavformat/ape.c +++ b/libavformat/ape.c @@ -242,6 +242,10 @@ static int ape_read_header(AVFormatContext * s, AVFormatParameters * ap) avio_seek(pb, ape->wavheaderlength, SEEK_CUR); } + if(!ape->totalframes){ + av_log(s, AV_LOG_ERROR, "No frames in the file!\n"); + return AVERROR(EINVAL); + } if(ape->totalframes > UINT_MAX / sizeof(APEFrame)){ av_log(s, AV_LOG_ERROR, "Too many frames: %d\n", ape->totalframes); return -1;