[FFmpeg-cvslog] Reject audio tracks with invalid interleaver parameters in RM demuxer.

[Laurent Aimar]

ffmpeg | branch: release/0.8 | Laurent Aimar <fenrir at videolan.org> | Sat Sep 17 16:56:33 2011 +0200| [24e0a9e451e1aae427307a919d78f6790f4e413c] | committer: Michael Niedermayer

Reject audio tracks with invalid interleaver parameters in RM demuxer.

Signed-off-by: Michael Niedermayer <michaelni at gmx.at>
(cherry picked from commit 4907f813581acd6cf68f1be9eb163464503e8208)

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=24e0a9e451e1aae427307a919d78f6790f4e413c
---

 libavformat/rmdec.c |   10 ++++++----
 1 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/libavformat/rmdec.c b/libavformat/rmdec.c
index b7c57af..cacca9b 100644
--- a/libavformat/rmdec.c
+++ b/libavformat/rmdec.c
@@ -192,8 +192,9 @@ static int rm_read_audio_stream_info(AVFormatContext *s, AVIOContext *pb,
             ast->audio_framesize = st->codec->block_align;
             st->codec->block_align = coded_framesize;
 
-            if(ast->audio_framesize >= UINT_MAX / sub_packet_h){
-                av_log(s, AV_LOG_ERROR, "ast->audio_framesize * sub_packet_h too large\n");
+            if (ast->audio_framesize <= 0 || sub_packet_h <= 0 ||
+                ast->audio_framesize >= UINT_MAX / sub_packet_h){
+                av_log(s, AV_LOG_ERROR, "ast->audio_framesize * sub_packet_h is invalid\n");
                 return -1;
             }
 
@@ -229,8 +230,9 @@ static int rm_read_audio_stream_info(AVFormatContext *s, AVIOContext *pb,
             if ((ret = rm_read_extradata(pb, st->codec, codecdata_length)) < 0)
                 return ret;
 
-            if(ast->audio_framesize >= UINT_MAX / sub_packet_h){
-                av_log(s, AV_LOG_ERROR, "rm->audio_framesize * sub_packet_h too large\n");
+            if (ast->audio_framesize <= 0 || sub_packet_h <= 0 ||
+                ast->audio_framesize >= UINT_MAX / sub_packet_h){
+                av_log(s, AV_LOG_ERROR, "rm->audio_framesize * sub_packet_h is invalid\n");
                 return -1;
             }