From e3f13d3a87274d537d319a84e9104f44f84ec3b2 Mon Sep 17 00:00:00 2001 From: Andreas Cadhalpun Date: Thu, 15 Dec 2016 02:14:31 +0100 Subject: [PATCH] 4xm: prevent overflow during block alignment calculation Reviewed-by: Michael Niedermayer Signed-off-by: Andreas Cadhalpun --- libavformat/4xm.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/libavformat/4xm.c b/libavformat/4xm.c index 2758b69d29..ead6d2b424 100644 --- a/libavformat/4xm.c +++ b/libavformat/4xm.c @@ -29,6 +29,7 @@ #include "libavutil/intreadwrite.h" #include "libavutil/intfloat.h" +#include "libavcodec/internal.h" #include "avformat.h" #include "internal.h" @@ -153,8 +154,10 @@ static int parse_strk(AVFormatContext *s, fourxm->tracks[track].audio_pts = 0; if (fourxm->tracks[track].channels <= 0 || + fourxm->tracks[track].channels > FF_SANE_NB_CHANNELS || fourxm->tracks[track].sample_rate <= 0 || - fourxm->tracks[track].bits <= 0) { + fourxm->tracks[track].bits <= 0 || + fourxm->tracks[track].bits > INT_MAX / FF_SANE_NB_CHANNELS) { av_log(s, AV_LOG_ERROR, "audio header invalid\n"); return AVERROR_INVALIDDATA; }