Commit 2dd0da78 authored by Clément Bœsch's avatar Clément Bœsch Committed by Clément Bœsch

lavf/mp3enc: make sure the header is valid before writing audio pkt.

An invalid header can lead avpriv_mpegaudio_decode_header() to overread
and/or div by zero.
parent ff3b59c8
...@@ -262,8 +262,14 @@ static int mp3_write_audio_packet(AVFormatContext *s, AVPacket *pkt) ...@@ -262,8 +262,14 @@ static int mp3_write_audio_packet(AVFormatContext *s, AVPacket *pkt)
if (pkt->data && pkt->size >= 4) { if (pkt->data && pkt->size >= 4) {
MPADecodeHeader c; MPADecodeHeader c;
int av_unused base; int av_unused base;
uint32_t head = AV_RB32(pkt->data);
avpriv_mpegaudio_decode_header(&c, AV_RB32(pkt->data)); if (ff_mpa_check_header(head) < 0) {
av_log(s, AV_LOG_WARNING, "Audio packet of size %d (starting with %08X...) "
"is invalid, writing it anyway.\n", pkt->size, head);
return ff_raw_write_packet(s, pkt);
}
avpriv_mpegaudio_decode_header(&c, head);
if (!mp3->initial_bitrate) if (!mp3->initial_bitrate)
mp3->initial_bitrate = c.bit_rate; mp3->initial_bitrate = c.bit_rate;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment