diff options
| author | Reimar Döffinger <Reimar.Doeffinger@gmx.de> | 2011-01-28 23:52:50 +0000 |
|---|---|---|
| committer | Mans Rullgard <mans@mansr.com> | 2011-01-29 13:48:13 +0000 |
| commit | ce20edb7bd6c1768ef5f4d181d7ba27a0e7945bd (patch) | |
| tree | 88e9b5b2245fa9fbbc6d360d62f4b00b9bfc17b2 /libavformat/oggparsevorbis.c | |
| parent | 0745116c10e5650952c39ea543c66b12fba854e6 (diff) | |
Vorbis-in-Ogg: Do not set timebase to invalid values
Avoids an assert when the sample rate is invalid and the timebase
is thus set to e.g. 1/0.
Sample file is http://samples.mplayerhq.hu/ogg/fuzzed-srate-crash.ogg
This is a quick fix for a crash, not a final solution.
Signed-off-by: Mans Rullgard <mans@mansr.com>
Diffstat (limited to 'libavformat/oggparsevorbis.c')
| -rw-r--r-- | libavformat/oggparsevorbis.c | 10 |
1 files changed, 7 insertions, 3 deletions
diff --git a/libavformat/oggparsevorbis.c b/libavformat/oggparsevorbis.c index cdb0266eee..d743d25e2d 100644 --- a/libavformat/oggparsevorbis.c +++ b/libavformat/oggparsevorbis.c @@ -221,6 +221,7 @@ vorbis_header (AVFormatContext * s, int idx) if (os->buf[os->pstart] == 1) { const uint8_t *p = os->buf + os->pstart + 7; /* skip "\001vorbis" tag */ unsigned blocksize, bs0, bs1; + int srate; if (os->psize != 30) return -1; @@ -229,7 +230,7 @@ vorbis_header (AVFormatContext * s, int idx) return -1; st->codec->channels = bytestream_get_byte(&p); - st->codec->sample_rate = bytestream_get_le32(&p); + srate = bytestream_get_le32(&p); p += 4; // skip maximum bitrate st->codec->bit_rate = bytestream_get_le32(&p); // nominal bitrate p += 4; // skip minimum bitrate @@ -249,8 +250,11 @@ vorbis_header (AVFormatContext * s, int idx) st->codec->codec_type = AVMEDIA_TYPE_AUDIO; st->codec->codec_id = CODEC_ID_VORBIS; - st->time_base.num = 1; - st->time_base.den = st->codec->sample_rate; + if (srate > 0) { + st->codec->sample_rate = srate; + st->time_base.num = 1; + st->time_base.den = srate; + } } else if (os->buf[os->pstart] == 3) { if (os->psize > 8) ff_vorbis_comment (s, &st->metadata, os->buf + os->pstart + 7, os->psize - 8); |