[libav-stable] alac: Limit max_samples_per_frame

Martin Storsjö git at libav.org
Tue Sep 3 22:04:56 CEST 2013


Module: libav
Branch: master
Commit: f7c5883126f9440547933eefcf000aa78af4821c

Author:    Martin Storsjö <martin at martin.st>
Committer: Martin Storsjö <martin at martin.st>
Date:      Tue Sep  3 11:54:03 2013 +0300

alac: Limit max_samples_per_frame

Otherwise buffer size calculations in allocate_buffers could
overflow later, making the code think a large enough buffer
actually was allocated.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable at libav.org
Signed-off-by: Martin Storsjö <martin at martin.st>

---

 libavcodec/alac.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/libavcodec/alac.c b/libavcodec/alac.c
index 9ef0653..d643dd3 100644
--- a/libavcodec/alac.c
+++ b/libavcodec/alac.c
@@ -494,7 +494,8 @@ static int alac_set_info(ALACContext *alac)
     bytestream2_skipu(&gb, 12); // size:4, alac:4, version:4
 
     alac->max_samples_per_frame = bytestream2_get_be32u(&gb);
-    if (!alac->max_samples_per_frame || alac->max_samples_per_frame > INT_MAX) {
+    if (!alac->max_samples_per_frame ||
+        alac->max_samples_per_frame > INT_MAX / sizeof(int32_t)) {
         av_log(alac->avctx, AV_LOG_ERROR, "max samples per frame invalid: %u\n",
                alac->max_samples_per_frame);
         return AVERROR_INVALIDDATA;



More information about the libav-stable mailing list