RepoMirrors/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2024-12-13 18:55:08 +00:00
Code Issues Projects Releases Wiki Activity

adx: validate header values

Browse Source
This commit is contained in:
Justin Ruggles 2011-11-19 17:51:36 -05:00
parent 8db67610c0
commit e2d1eace00
1 changed files with 12 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
libavcodec/adxdec.c
View File

@ -93,7 +93,7 @@ static void adx_decode_stereo(int16_t *out,const uint8_t *in,
* @param avctx codec context
* @param buf packet data
* @param bufsize packet size
* @return data offset or 0 if header is invalid
* @return data offset or negative error code if header is invalid
*/
static int adx_decode_header(AVCodecContext *avctx, const uint8_t *buf,
int bufsize)
@ -101,13 +101,18 @@ static int adx_decode_header(AVCodecContext *avctx, const uint8_t *buf,
int offset;
if (buf[0] != 0x80)
return 0;
return AVERROR_INVALIDDATA;
offset = (AV_RB32(buf) ^ 0x80000000) + 4;
if (bufsize < offset || memcmp(buf + offset - 6, "(c)CRI", 6))
return 0;
return AVERROR_INVALIDDATA;
avctx->channels = buf[7];
if (avctx->channels > 2)
return AVERROR_INVALIDDATA;
avctx->sample_rate = AV_RB32(buf + 8);
if (avctx->sample_rate < 1 ||
avctx->sample_rate > INT_MAX / (avctx->channels * 18 * 8))
return AVERROR_INVALIDDATA;
avctx->bit_rate = avctx->sample_rate * avctx->channels * 18 * 8 / 32;
return offset;
@ -125,8 +130,10 @@ static int adx_decode_frame(AVCodecContext *avctx, void *data, int *data_size,
if (!c->header_parsed) {
int hdrsize = adx_decode_header(avctx, buf, rest);
if (!hdrsize)
return -1;
if (hdrsize < 0) {
av_log(avctx, AV_LOG_ERROR, "invalid stream header\n");
return hdrsize;
}
c->header_parsed = 1;
buf += hdrsize;
rest -= hdrsize;