Commit be894d6c authored by Michael Niedermayer's avatar Michael Niedermayer

Merge commit 'c837b38d'

* commit 'c837b38d':
  au: move skipping of unused data to before parameter validation
  au: do not arbitrarily limit channel count

Conflicts:
	libavformat/au.c
Merged-by: 's avatarMichael Niedermayer <michaelni@gmx.at>
parents 0287eea9 c837b38d
...@@ -63,6 +63,8 @@ static int au_probe(AVProbeData *p) ...@@ -63,6 +63,8 @@ static int au_probe(AVProbeData *p)
return 0; return 0;
} }
#define BLOCK_SIZE 1024
/* au input */ /* au input */
static int au_read_header(AVFormatContext *s) static int au_read_header(AVFormatContext *s)
{ {
...@@ -90,6 +92,11 @@ static int au_read_header(AVFormatContext *s) ...@@ -90,6 +92,11 @@ static int au_read_header(AVFormatContext *s)
rate = avio_rb32(pb); rate = avio_rb32(pb);
channels = avio_rb32(pb); channels = avio_rb32(pb);
if (size > 24) {
/* skip unused data */
avio_skip(pb, size - 24);
}
codec = ff_codec_get_id(codec_au_tags, id); codec = ff_codec_get_id(codec_au_tags, id);
if (codec == AV_CODEC_ID_NONE) { if (codec == AV_CODEC_ID_NONE) {
...@@ -103,16 +110,11 @@ static int au_read_header(AVFormatContext *s) ...@@ -103,16 +110,11 @@ static int au_read_header(AVFormatContext *s)
return AVERROR_PATCHWELCOME; return AVERROR_PATCHWELCOME;
} }
if (channels == 0 || channels > 64) { if (channels == 0 || channels >= INT_MAX / (BLOCK_SIZE * bps >> 3)) {
av_log(s, AV_LOG_ERROR, "Invalid number of channels %d\n", channels); av_log(s, AV_LOG_ERROR, "Invalid number of channels %d\n", channels);
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
} }
if (size >= 24) {
/* skip unused data */
avio_skip(pb, size - 24);
}
/* now we are ready: build format streams */ /* now we are ready: build format streams */
st = avformat_new_stream(s, NULL); st = avformat_new_stream(s, NULL);
if (!st) if (!st)
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment