From 9ec8790ac4787d3d514c5fa27b66d581614fd1be Mon Sep 17 00:00:00 2001 From: Andreas Cadhalpun Date: Thu, 26 Jan 2017 01:19:02 +0100 Subject: boadec: prevent overflow during block alignment calculation Reviewed-by: Michael Niedermayer Signed-off-by: Andreas Cadhalpun --- libavformat/boadec.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/libavformat/boadec.c b/libavformat/boadec.c index ac2a33b3f0..6055effcad 100644 --- a/libavformat/boadec.c +++ b/libavformat/boadec.c @@ -20,6 +20,7 @@ */ #include "libavutil/intreadwrite.h" +#include "libavcodec/internal.h" #include "avformat.h" #include "internal.h" @@ -53,9 +54,20 @@ static int read_header(AVFormatContext *s) avio_rl32(s->pb); st->codecpar->sample_rate = avio_rl32(s->pb); st->codecpar->channels = avio_rl32(s->pb); + if (st->codecpar->channels > FF_SANE_NB_CHANNELS) { + av_log(s, AV_LOG_ERROR, "Too many channels %d > %d\n", + st->codecpar->channels, FF_SANE_NB_CHANNELS); + return AVERROR(ENOSYS); + } s->internal->data_offset = avio_rl32(s->pb); avio_r8(s->pb); - st->codecpar->block_align = st->codecpar->channels * avio_rl32(s->pb); + st->codecpar->block_align = avio_rl32(s->pb); + if (st->codecpar->block_align > INT_MAX / FF_SANE_NB_CHANNELS) { + av_log(s, AV_LOG_ERROR, "Too large block alignment %d > %d\n", + st->codecpar->block_align, INT_MAX / FF_SANE_NB_CHANNELS); + return AVERROR_INVALIDDATA; + } + st->codecpar->block_align *= st->codecpar->channels; avio_seek(s->pb, s->internal->data_offset, SEEK_SET); -- cgit v1.2.3