Commit 0009457d authored by Andreas Cadhalpun's avatar Andreas Cadhalpun

ffmdec: validate sample_rate

A negative sample rate doesn't make sense and triggers assertions in
av_rescale_rnd.
Signed-off-by: 's avatarAndreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
parent 872fcfcc
...@@ -432,6 +432,11 @@ static int ffm2_read_header(AVFormatContext *s) ...@@ -432,6 +432,11 @@ static int ffm2_read_header(AVFormatContext *s)
goto fail; goto fail;
} }
codec->sample_rate = avio_rb32(pb); codec->sample_rate = avio_rb32(pb);
if (codec->sample_rate <= 0) {
av_log(s, AV_LOG_ERROR, "Invalid sample rate %d\n", codec->sample_rate);
ret = AVERROR_INVALIDDATA;
goto fail;
}
codec->channels = avio_rl16(pb); codec->channels = avio_rl16(pb);
codec->frame_size = avio_rl16(pb); codec->frame_size = avio_rl16(pb);
break; break;
...@@ -628,6 +633,10 @@ static int ffm_read_header(AVFormatContext *s) ...@@ -628,6 +633,10 @@ static int ffm_read_header(AVFormatContext *s)
break; break;
case AVMEDIA_TYPE_AUDIO: case AVMEDIA_TYPE_AUDIO:
codec->sample_rate = avio_rb32(pb); codec->sample_rate = avio_rb32(pb);
if (codec->sample_rate <= 0) {
av_log(s, AV_LOG_ERROR, "Invalid sample rate %d\n", codec->sample_rate);
goto fail;
}
codec->channels = avio_rl16(pb); codec->channels = avio_rl16(pb);
codec->frame_size = avio_rl16(pb); codec->frame_size = avio_rl16(pb);
break; break;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment