From: Laurent Aimar <[email protected]>
---
libavformat/rmdec.c | 10 ++++++----
1 files changed, 6 insertions(+), 4 deletions(-)
diff --git a/libavformat/rmdec.c b/libavformat/rmdec.c
index 1c96573..81f563e 100644
--- a/libavformat/rmdec.c
+++ b/libavformat/rmdec.c
@@ -215,8 +215,9 @@ static int rm_read_audio_stream_info(AVFormatContext *s,
AVIOContext *pb,
ast->audio_framesize = st->codec->block_align;
st->codec->block_align = coded_framesize;
- if(ast->audio_framesize >= UINT_MAX / sub_packet_h){
- av_log(s, AV_LOG_ERROR, "ast->audio_framesize * sub_packet_h
too large\n");
+ if (ast->audio_framesize <= 0 || sub_packet_h <= 0 ||
+ ast->audio_framesize >= UINT_MAX / sub_packet_h){
+ av_log(s, AV_LOG_ERROR, "ast->audio_framesize * sub_packet_h
is invalid\n");
return -1;
}
@@ -252,8 +253,9 @@ static int rm_read_audio_stream_info(AVFormatContext *s,
AVIOContext *pb,
if ((ret = rm_read_extradata(pb, st->codec, codecdata_length)) < 0)
return ret;
- if(ast->audio_framesize >= UINT_MAX / sub_packet_h){
- av_log(s, AV_LOG_ERROR, "rm->audio_framesize * sub_packet_h
too large\n");
+ if (ast->audio_framesize <= 0 || sub_packet_h <= 0 ||
+ ast->audio_framesize >= UINT_MAX / sub_packet_h){
+ av_log(s, AV_LOG_ERROR, "rm->audio_framesize * sub_packet_h is
invalid\n");
return -1;
}
--
1.7.2.5
_______________________________________________
libav-devel mailing list
[email protected]
https://lists.libav.org/mailman/listinfo/libav-devel
