From fb48f825e33c15146b8ce4e5258332ebc4a9b5ea Mon Sep 17 00:00:00 2001
From: Justin Ruggles <justin.ruggles@gmail.com>
Date: Sun, 23 Dec 2012 13:26:44 -0500
Subject: au: do not arbitrarily limit channel count

Nothing in the AU specification sets a limit on channel count.
We only need to avoid an overflow in the packet size calculation.
---
 libavformat/au.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

(limited to 'libavformat/au.c')

diff --git a/libavformat/au.c b/libavformat/au.c
index fb35a9a613..c429ce100d 100644
--- a/libavformat/au.c
+++ b/libavformat/au.c
@@ -57,6 +57,8 @@ static int au_probe(AVProbeData *p)
         return 0;
 }
 
+#define BLOCK_SIZE 1024
+
 /* au input */
 static int au_read_header(AVFormatContext *s)
 {
@@ -92,7 +94,7 @@ static int au_read_header(AVFormatContext *s)
         return AVERROR_PATCHWELCOME;
     }
 
-    if (channels == 0 || channels > 64) {
+    if (channels == 0 || channels >= INT_MAX / (BLOCK_SIZE * bps >> 3)) {
         av_log(s, AV_LOG_ERROR, "Invalid number of channels %d\n", channels);
         return AVERROR_INVALIDDATA;
     }
@@ -117,8 +119,6 @@ static int au_read_header(AVFormatContext *s)
     return 0;
 }
 
-#define BLOCK_SIZE 1024
-
 static int au_read_packet(AVFormatContext *s,
                           AVPacket *pkt)
 {
-- 
cgit v1.2.3


From c837b38dd33a11c3810e988a60193a858eb4f58c Mon Sep 17 00:00:00 2001
From: Justin Ruggles <justin.ruggles@gmail.com>
Date: Sun, 23 Dec 2012 13:33:33 -0500
Subject: au: move skipping of unused data to before parameter validation

Also do not unnecessarily skip 0 bytes.
---
 libavformat/au.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

(limited to 'libavformat/au.c')

diff --git a/libavformat/au.c b/libavformat/au.c
index c429ce100d..f055a6fdf2 100644
--- a/libavformat/au.c
+++ b/libavformat/au.c
@@ -81,6 +81,11 @@ static int au_read_header(AVFormatContext *s)
     rate = avio_rb32(pb);
     channels = avio_rb32(pb);
 
+    if (size > 24) {
+        /* skip unused data */
+        avio_skip(pb, size - 24);
+    }
+
     codec = ff_codec_get_id(codec_au_tags, id);
 
     if (codec == AV_CODEC_ID_NONE) {
@@ -99,11 +104,6 @@ static int au_read_header(AVFormatContext *s)
         return AVERROR_INVALIDDATA;
     }
 
-    if (size >= 24) {
-        /* skip unused data */
-        avio_skip(pb, size - 24);
-    }
-
     /* now we are ready: build format streams */
     st = avformat_new_stream(s, NULL);
     if (!st)
-- 
cgit v1.2.3