[FFmpeg-cvslog] Do not attempt to decode APE file with no frames

Kostya git at videolan.org
Sat Mar 19 18:18:57 CET 2011


ffmpeg | branch: release/0.6 | Kostya <kostya.shishkov at gmail.com> | Tue Mar 15 09:19:43 2011 +0000| [f9bf2a4ab10a0718a11d43fecba75bb40aac6628] | committer: Reinhard Tartler

Do not attempt to decode APE file with no frames

This fixes invalid reads/writes with this sample:
http://packetstorm.linuxsecurity.com/1103-exploits/vlc105-dos.txt
(cherry picked from commit 8312e3fc9041027a33c8bc667bb99740fdf41dd5)

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=f9bf2a4ab10a0718a11d43fecba75bb40aac6628
---

 libavformat/ape.c |    4 ++++
 1 files changed, 4 insertions(+), 0 deletions(-)

diff --git a/libavformat/ape.c b/libavformat/ape.c
index 91acf72..0ebc307 100644
--- a/libavformat/ape.c
+++ b/libavformat/ape.c
@@ -242,6 +242,10 @@ static int ape_read_header(AVFormatContext * s, AVFormatParameters * ap)
             url_fskip(pb, ape->wavheaderlength);
     }
 
+    if(!ape->totalframes){
+        av_log(s, AV_LOG_ERROR, "No frames in the file!\n");
+        return AVERROR(EINVAL);
+    }
     if(ape->totalframes > UINT_MAX / sizeof(APEFrame)){
         av_log(s, AV_LOG_ERROR, "Too many frames: %d\n", ape->totalframes);
         return -1;




More information about the ffmpeg-cvslog mailing list