Commit c2ca0163 authored by Michael Niedermayer's avatar Michael Niedermayer

matroskadec: check h in generic rm packet shuffler

Fixes crash

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: 's avatarMichael Niedermayer <michaelni@gmx.at>
parent 1f41cffe
...@@ -2032,7 +2032,7 @@ static int matroska_parse_rm_audio(MatroskaDemuxContext *matroska, ...@@ -2032,7 +2032,7 @@ static int matroska_parse_rm_audio(MatroskaDemuxContext *matroska,
} }
memcpy(track->audio.buf + y*w, data, w); memcpy(track->audio.buf + y*w, data, w);
} else { } else {
if (size < sps * w / sps) { if (size < sps * w / sps || h<=0) {
av_log(matroska->ctx, AV_LOG_ERROR, av_log(matroska->ctx, AV_LOG_ERROR,
"Corrupt generic RM-style audio packet size\n"); "Corrupt generic RM-style audio packet size\n");
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment