Merge commit 'ed50673066956d6f2201a57c3254569f2ab08d9d'

* commit 'ed50673066956d6f2201a57c3254569f2ab08d9d':
  wavpack: validate samples size parsed in wavpack_decode_block

Merged-by: Michael Niedermayer <michaelni@gmx.at>

1 files changed, 5 insertions, 4 deletions

diff --git a/libavcodec/wavpack.c b/libavcodec/wavpack.c
index c618537309..ca22620b9e 100644
--- a/libavcodec/wavpack.c
+++ b/libavcodec/wavpack.c
@@ -807,14 +807,15 @@ static int wavpack_decode_block(AVCodecContext *avctx, int block_no,
     if (!wc->mkv_mode) {
         s->samples = AV_RL32(buf);
         buf       += 4;
+        if (s->samples != wc->samples) {
+            av_log(avctx, AV_LOG_ERROR, "mismatching sample count in block");
+            return AVERROR_INVALIDDATA;
+        }
+
         if (!s->samples) {
             *got_frame_ptr = 0;
             return 0;
         }
-        if (s->samples > wc->samples) {
-            av_log(avctx, AV_LOG_ERROR, "too many samples in block");
-            return -1;
-        }
     } else {
         s->samples = wc->samples;
     }