Commit 0933fd15 authored by Luca Barbato's avatar Luca Barbato

oma: Validate sample rates

The sample rate index is 3 bits even if currently index 5, 6 and 7 are
not supported.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
parent f2f57d16
......@@ -22,7 +22,7 @@
#include "oma.h"
#include "libavcodec/avcodec.h"
const uint16_t ff_oma_srate_tab[6] = { 320, 441, 480, 882, 960, 0 };
const uint16_t ff_oma_srate_tab[8] = { 320, 441, 480, 882, 960, 0 };
const AVCodecTag ff_oma_codec_tags[] = {
{ AV_CODEC_ID_ATRAC3, OMA_CODECID_ATRAC3 },
......
......@@ -37,7 +37,7 @@ enum {
OMA_CODECID_WMA = 5,
};
extern const uint16_t ff_oma_srate_tab[6];
extern const uint16_t ff_oma_srate_tab[8];
extern const AVCodecTag ff_oma_codec_tags[];
......
......@@ -304,7 +304,11 @@ static int oma_read_header(AVFormatContext *s)
switch (buf[32]) {
case OMA_CODECID_ATRAC3:
samplerate = ff_oma_srate_tab[(codec_params >> 13) & 7]*100;
samplerate = ff_oma_srate_tab[(codec_params >> 13) & 7] * 100;
if (!samplerate) {
av_log(s, AV_LOG_ERROR, "Unsupported sample rate\n");
return AVERROR_INVALIDDATA;
}
if (samplerate != 44100)
avpriv_request_sample(s, "Sample rate %d", samplerate);
......@@ -334,9 +338,14 @@ static int oma_read_header(AVFormatContext *s)
case OMA_CODECID_ATRAC3P:
st->codec->channels = (codec_params >> 10) & 7;
framesize = ((codec_params & 0x3FF) * 8) + 8;
st->codec->sample_rate = ff_oma_srate_tab[(codec_params >> 13) & 7]*100;
st->codec->bit_rate = st->codec->sample_rate * framesize * 8 / 1024;
avpriv_set_pts_info(st, 64, 1, st->codec->sample_rate);
samplerate = ff_oma_srate_tab[(codec_params >> 13) & 7] * 100;
if (!samplerate) {
av_log(s, AV_LOG_ERROR, "Unsupported sample rate\n");
return AVERROR_INVALIDDATA;
}
st->codec->sample_rate = samplerate;
st->codec->bit_rate = samplerate * framesize * 8 / 1024;
avpriv_set_pts_info(st, 64, 1, samplerate);
av_log(s, AV_LOG_ERROR, "Unsupported codec ATRAC3+!\n");
break;
case OMA_CODECID_MP3:
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment