commit 648dc68098a2d484ebf7b4c48baa3d08e34adef0
author Laurent Aimar <fenrir@videolan.org> Sat Sep 17 16:56:33 2011 +0200
committer Michael Niedermayer <michaelni@gmx.at> Sun Nov 06 18:32:11 2011 +0100
tree af2394a804fdd1f9316d8f6214d3ed52d75efe13
parent 10da0edddcc0b84ab9898a410969c457cd8ce528

Reject audio tracks with invalid interleaver parameters in RM demuxer.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 4907f813581acd6cf68f1be9eb163464503e8208)
(cherry picked from commit 24e0a9e451e1aae427307a919d78f6790f4e413c)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

libavformat/rmdec.c

diff --git a/libavformat/rmdec.c b/libavformat/rmdec.c
index 5e3b3c7..65bc79c 100644
--- a/libavformat/rmdec.c
+++ b/libavformat/rmdec.c
@@ -154,8 +154,9 @@
             ast->audio_framesize = st->codec->block_align;
             st->codec->block_align = coded_framesize;
 
-            if(ast->audio_framesize >= UINT_MAX / sub_packet_h){
-                av_log(s, AV_LOG_ERROR, "ast->audio_framesize * sub_packet_h too large\n");
+            if (ast->audio_framesize <= 0 || sub_packet_h <= 0 ||
+                ast->audio_framesize >= UINT_MAX / sub_packet_h){
+                av_log(s, AV_LOG_ERROR, "ast->audio_framesize * sub_packet_h is invalid\n");
                 return -1;
             }
 
@@ -185,8 +186,9 @@
             ast->audio_framesize = st->codec->block_align;
             st->codec->block_align = ast->sub_packet_size;
 
-            if(ast->audio_framesize >= UINT_MAX / sub_packet_h){
-                av_log(s, AV_LOG_ERROR, "rm->audio_framesize * sub_packet_h too large\n");
+            if (ast->audio_framesize <= 0 || sub_packet_h <= 0 ||
+                ast->audio_framesize >= UINT_MAX / sub_packet_h){
+                av_log(s, AV_LOG_ERROR, "rm->audio_framesize * sub_packet_h is invalid\n");
                 return -1;
             }