diff options
| author | wg <video06@malloc.de> | 2007-12-17 10:41:47 +0000 |
|---|---|---|
| committer | Benoit Fouet <benoit.fouet@free.fr> | 2007-12-17 10:41:47 +0000 |
| commit | 3426d575bf46edc0f52d15f7e7c1d199e8688faa (patch) | |
| tree | 5f4f49a4da4be172c7cc571dc9734a800c05cd28 /libavcodec/pcm.c | |
| parent | fa13095a5db7c1eb9b04e3adaf95423819fa62b0 (diff) | |
Fix crash in PCM decoder when number of channels is not set.
Patch by "wg": video06 malloc de
See Issue298
Originally committed as revision 11249 to svn://svn.ffmpeg.org/ffmpeg/trunk
Diffstat (limited to 'libavcodec/pcm.c')
| -rw-r--r-- | libavcodec/pcm.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/libavcodec/pcm.c b/libavcodec/pcm.c index 560e2e3884..c7a7e82477 100644 --- a/libavcodec/pcm.c +++ b/libavcodec/pcm.c @@ -384,10 +384,14 @@ static int pcm_decode_frame(AVCodecContext *avctx, src = buf; n= av_get_bits_per_sample(avctx->codec_id)/8; - if((n && buf_size % n) || avctx->channels > MAX_CHANNELS){ + if(n && buf_size % n){ av_log(avctx, AV_LOG_ERROR, "invalid PCM packet\n"); return -1; } + if(avctx->channels <= 0 || avctx->channels > MAX_CHANNELS){ + av_log(avctx, AV_LOG_ERROR, "PCM channels out of bounds\n"); + return -1; + } buf_size= FFMIN(buf_size, *data_size/2); *data_size=0; |