[FFmpeg-cvslog] rmdec: when using INT4 deinterleaving, error out if sub_packet_h <= 1.
Ronald S. Bultje
git at videolan.org
Thu Feb 23 05:03:03 CET 2012
ffmpeg | branch: master | Ronald S. Bultje <rsbultje at gmail.com> | Tue Feb 21 10:36:27 2012 -0800| [e30b3e59a4f3004337cb1623b2aac988ce52b93f] | committer: Ronald S. Bultje
rmdec: when using INT4 deinterleaving, error out if sub_packet_h <= 1.
We read sub_packet_h / 2 packets per line of data (during deinterleaving),
which equals zero if sub_packet_h <= 1, thus causing us to not read any
data, leading to an infinite loop.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable at libav.org
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=e30b3e59a4f3004337cb1623b2aac988ce52b93f
---
libavformat/rmdec.c | 1 +
1 files changed, 1 insertions(+), 0 deletions(-)
diff --git a/libavformat/rmdec.c b/libavformat/rmdec.c
index ee8abdd..ed16b07 100644
--- a/libavformat/rmdec.c
+++ b/libavformat/rmdec.c
@@ -265,6 +265,7 @@ static int rm_read_audio_stream_info(AVFormatContext *s, AVIOContext *pb,
switch (ast->deint_id) {
case DEINT_ID_INT4:
if (ast->coded_framesize > ast->audio_framesize ||
+ sub_packet_h <= 1 ||
ast->coded_framesize * sub_packet_h > (2 + (sub_packet_h & 1)) * ast->audio_framesize)
return AVERROR_INVALIDDATA;
break;
More information about the ffmpeg-cvslog
mailing list