[FFmpeg-cvslog] smacker: check frame size validity

[Kostya Shishkov]

ffmpeg | branch: release/0.10 | Kostya Shishkov <kostya.shishkov at gmail.com> | Wed Jun 12 14:30:51 2013 +0200| [b40870e636401ddbc97f966a60a21780e1eb17ca] | committer: Reinhard Tartler

smacker: check frame size validity

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable at libav.org

Signed-off-by: Luca Barbato <lu_zero at gentoo.org>
(cherry picked from commit 07423ad7836325e03894f2f87ba46a531a1cc0b3)

Signed-off-by: Luca Barbato <lu_zero at gentoo.org>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=b40870e636401ddbc97f966a60a21780e1eb17ca
---

 libavformat/smacker.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/libavformat/smacker.c b/libavformat/smacker.c
index e7c89e0..d6bb213 100644
--- a/libavformat/smacker.c
+++ b/libavformat/smacker.c
@@ -297,10 +297,14 @@ static int smacker_read_packet(AVFormatContext *s, AVPacket *pkt)
         /* if audio chunks are present, put them to stack and retrieve later */
         for(i = 0; i < 7; i++) {
             if(flags & 1) {
-                int size;
+                uint32_t size;
                 uint8_t *tmpbuf;
 
                 size = avio_rl32(s->pb) - 4;
+                if (!size || size > frame_size) {
+                    av_log(s, AV_LOG_ERROR, "Invalid audio part size\n");
+                    return AVERROR_INVALIDDATA;
+                }
                 frame_size -= size;
                 frame_size -= 4;
                 smk->curstream++;