diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-12-17 20:51:07 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-12-17 20:51:50 +0100 |
| commit | 1d29624c73fde14a987735b3d4df8d005caebb58 (patch) | |
| tree | b733a69cf85d97ab594f75582e29e1b29f5c89f7 /libavformat/oggparsevorbis.c | |
| parent | 2f7465b5bf6ca6aff5a3f0dd671695e86972538c (diff) | |
oggparsevorbis: check channels
Fixes out of array accesses
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavformat/oggparsevorbis.c')
| -rw-r--r-- | libavformat/oggparsevorbis.c | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/libavformat/oggparsevorbis.c b/libavformat/oggparsevorbis.c index 09f5205fbb..7e8f6cede3 100644 --- a/libavformat/oggparsevorbis.c +++ b/libavformat/oggparsevorbis.c @@ -230,6 +230,7 @@ vorbis_header (AVFormatContext * s, int idx) const uint8_t *p = os->buf + os->pstart + 7; /* skip "\001vorbis" tag */ unsigned blocksize, bs0, bs1; int srate; + int channels; if (os->psize != 30) return -1; @@ -237,7 +238,12 @@ vorbis_header (AVFormatContext * s, int idx) if (bytestream_get_le32(&p) != 0) /* vorbis_version */ return -1; - st->codec->channels = bytestream_get_byte(&p); + channels= bytestream_get_byte(&p); + if (st->codec->channels && channels != st->codec->channels) { + av_log(s, AV_LOG_ERROR, "Channel change is not supported\n"); + return AVERROR_PATCHWELCOME; + } + st->codec->channels = channels; srate = bytestream_get_le32(&p); p += 4; // skip maximum bitrate st->codec->bit_rate = bytestream_get_le32(&p); // nominal bitrate |