From bdb8d99613589e4df416d4255e875ab15f5375dd Mon Sep 17 00:00:00 2001
From: Benjamin Larsson <banan@ludd.ltu.se>
Date: Sat, 25 Apr 2009 20:09:34 +0000
Subject: Proper subpacket size check for cook multichannel files.

Originally committed as revision 18693 to svn://svn.ffmpeg.org/ffmpeg/trunk
---
 libavcodec/cook.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/libavcodec/cook.c b/libavcodec/cook.c
index 923c8e3756..a33222bf0e 100644
--- a/libavcodec/cook.c
+++ b/libavcodec/cook.c
@@ -72,7 +72,7 @@ typedef struct {
 
 typedef struct {
     int                 ch_idx;
-    unsigned int        size;
+    int                 size;
     int                 num_channels;
     int                 cookversion;
     int                 samples_per_frame;
@@ -1011,6 +1011,10 @@ static int cook_decode_frame(AVCodecContext *avctx,
     for(i=1;i<q->num_subpackets;i++){
         q->subpacket[i].size = 2 * buf[avctx->block_align - q->num_subpackets + i];
         q->subpacket[0].size -= q->subpacket[i].size + 1;
+        if (q->subpacket[0].size < 0) {
+            av_log(avctx,AV_LOG_DEBUG,"frame subpacket size total > avctx->block_align!\n");
+            return -1;
+        }
     }
 
     /* decode supbackets */
-- 
cgit v1.2.3