This could occur due to integer overflow when reading the channel count from
the extradata.
---
libavcodec/twinvq.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/libavcodec/twinvq.c b/libavcodec/twinvq.c
index d009196..50ee626 100644
--- a/libavcodec/twinvq.c
+++ b/libavcodec/twinvq.c
@@ -1126,7 +1126,7 @@ static av_cold int twin_decode_init(AVCodecContext *avctx)
default: avctx->sample_rate = isampf * 1000; break;
}
- if (avctx->channels > CHANNELS_MAX) {
+ if (avctx->channels <= 0 || avctx->channels > CHANNELS_MAX) {
av_log(avctx, AV_LOG_ERROR, "Unsupported number of channels: %i\n",
avctx->channels);
return -1;
--
1.7.1
_______________________________________________
libav-devel mailing list
libav-devel@libav.org
https://lists.libav.org/mailman/listinfo/libav-devel
