Merge commit 'c837b38dd33a11c3810e988a60193a858eb4f58c'

* commit 'c837b38dd33a11c3810e988a60193a858eb4f58c':
  au: move skipping of unused data to before parameter validation
  au: do not arbitrarily limit channel count

Conflicts:
	libavformat/au.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>

1 files changed, 8 insertions, 6 deletions

diff --git a/libavformat/au.c b/libavformat/au.c
index 6d1d9abc52..e4245a1de1 100644
--- a/libavformat/au.c
+++ b/libavformat/au.c
@@ -63,6 +63,8 @@ static int au_probe(AVProbeData *p)
         return 0;
 }
 
+#define BLOCK_SIZE 1024
+
 /* au input */
 static int au_read_header(AVFormatContext *s)
 {
@@ -90,6 +92,11 @@ static int au_read_header(AVFormatContext *s)
     rate = avio_rb32(pb);
     channels = avio_rb32(pb);
 
+    if (size > 24) {
+        /* skip unused data */
+        avio_skip(pb, size - 24);
+    }
+
     codec = ff_codec_get_id(codec_au_tags, id);
 
     if (codec == AV_CODEC_ID_NONE) {
@@ -103,16 +110,11 @@ static int au_read_header(AVFormatContext *s)
         return AVERROR_PATCHWELCOME;
     }
 
-    if (channels == 0 || channels > 64) {
+    if (channels == 0 || channels >= INT_MAX / (BLOCK_SIZE * bps >> 3)) {
         av_log(s, AV_LOG_ERROR, "Invalid number of channels %d\n", channels);
         return AVERROR_INVALIDDATA;
     }
 
-    if (size >= 24) {
-        /* skip unused data */
-        avio_skip(pb, size - 24);
-    }
-
     /* now we are ready: build format streams */
     st = avformat_new_stream(s, NULL);
     if (!st)