From 8cc72ce5a0d8ab6bc88d28cf55cd62674240121d Mon Sep 17 00:00:00 2001
From: Justin Ruggles <justin.ruggles@gmail.com>
Date: Tue, 23 Oct 2012 13:15:24 -0400
Subject: twinvq: validate that channels is not <= 0

This could occur due to integer overflow when reading the channel count from
the extradata.
---
 libavcodec/twinvq.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'libavcodec/twinvq.c')

diff --git a/libavcodec/twinvq.c b/libavcodec/twinvq.c
index d009196445..50ee6266b3 100644
--- a/libavcodec/twinvq.c
+++ b/libavcodec/twinvq.c
@@ -1126,7 +1126,7 @@ static av_cold int twin_decode_init(AVCodecContext *avctx)
     default: avctx->sample_rate = isampf * 1000; break;
     }
 
-    if (avctx->channels > CHANNELS_MAX) {
+    if (avctx->channels <= 0 || avctx->channels > CHANNELS_MAX) {
         av_log(avctx, AV_LOG_ERROR, "Unsupported number of channels: %i\n",
                avctx->channels);
         return -1;
-- 
cgit v1.2.3