diff options
Diffstat (limited to 'libavformat/au.c')
| -rw-r--r-- | libavformat/au.c | 14 |
1 files changed, 8 insertions, 6 deletions
diff --git a/libavformat/au.c b/libavformat/au.c index 6d1d9abc52..e4245a1de1 100644 --- a/libavformat/au.c +++ b/libavformat/au.c @@ -63,6 +63,8 @@ static int au_probe(AVProbeData *p) return 0; } +#define BLOCK_SIZE 1024 + /* au input */ static int au_read_header(AVFormatContext *s) { @@ -90,6 +92,11 @@ static int au_read_header(AVFormatContext *s) rate = avio_rb32(pb); channels = avio_rb32(pb); + if (size > 24) { + /* skip unused data */ + avio_skip(pb, size - 24); + } + codec = ff_codec_get_id(codec_au_tags, id); if (codec == AV_CODEC_ID_NONE) { @@ -103,16 +110,11 @@ static int au_read_header(AVFormatContext *s) return AVERROR_PATCHWELCOME; } - if (channels == 0 || channels > 64) { + if (channels == 0 || channels >= INT_MAX / (BLOCK_SIZE * bps >> 3)) { av_log(s, AV_LOG_ERROR, "Invalid number of channels %d\n", channels); return AVERROR_INVALIDDATA; } - if (size >= 24) { - /* skip unused data */ - avio_skip(pb, size - 24); - } - /* now we are ready: build format streams */ st = avformat_new_stream(s, NULL); if (!st) |