[FFmpeg-cvslog] xmv: Add more sanity checks for parameters read from the bitstream

[Martin Storsjö]

ffmpeg | branch: release/0.10 | Martin Storsjö <martin at martin.st> | Mon Sep 16 21:27:49 2013 +0300| [0a23055b8ab24800774a7079921791acb92fe0f2] | committer: Luca Barbato

xmv: Add more sanity checks for parameters read from the bitstream

Since the number of channels is multiplied by 36 and assigned to
to a uint16_t, make sure this calculation didn't overflow. (In
certain cases the calculation could overflow leaving the
truncated block_align at 0, leading to divisions by zero later.)

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable at libav.org
Signed-off-by: Martin Storsjö <martin at martin.st>
(cherry picked from commit d4c2a3740fb95f952a87ba320d2bf31f126bdf68)
Signed-off-by: Luca Barbato <lu_zero at gentoo.org>
(cherry picked from commit 00516b5491fbd99e4057f21eae231fc02cc596e3)

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=0a23055b8ab24800774a7079921791acb92fe0f2
---

 libavformat/xmv.c |    7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/libavformat/xmv.c b/libavformat/xmv.c
index 8249ce1..f0950c0 100644
--- a/libavformat/xmv.c
+++ b/libavformat/xmv.c
@@ -43,6 +43,8 @@
                            XMV_AUDIO_ADPCM51_FRONTCENTERLOW | \
                            XMV_AUDIO_ADPCM51_REARLEFTRIGHT)
 
+#define XMV_BLOCK_ALIGN_SIZE 36
+
 typedef struct XMVAudioTrack {
     uint16_t compression;
     uint16_t channels;
@@ -208,7 +210,7 @@ static int xmv_read_header(AVFormatContext *s,
         track->bit_rate      = track->bits_per_sample *
                                track->sample_rate *
                                track->channels;
-        track->block_align   = 36 * track->channels;
+        track->block_align   = XMV_BLOCK_ALIGN_SIZE * track->channels;
         track->block_samples = 64;
         track->codec_id      = ff_wav_codec_get_id(track->compression,
                                                    track->bits_per_sample);
@@ -225,7 +227,8 @@ static int xmv_read_header(AVFormatContext *s,
             av_log(s, AV_LOG_WARNING, "Unsupported 5.1 ADPCM audio stream "
                                       "(0x%04X)\n", track->flags);
 
-        if (!track->channels || !track->sample_rate) {
+        if (!track->channels || !track->sample_rate ||
+             track->channels >= UINT16_MAX / XMV_BLOCK_ALIGN_SIZE) {
             av_log(s, AV_LOG_ERROR, "Invalid parameters for audio track %d.\n",
                    audio_track);
             ret = AVERROR_INVALIDDATA;