From c2ca0163affa524f4074c6328bf85c944b65dba2 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sun, 11 Nov 2012 01:00:04 +0100 Subject: matroskadec: check h in generic rm packet shuffler Fixes crash Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer --- libavformat/matroskadec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'libavformat') diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c index ec279ed3c9..61ba6ec2d6 100644 --- a/libavformat/matroskadec.c +++ b/libavformat/matroskadec.c @@ -2032,7 +2032,7 @@ static int matroska_parse_rm_audio(MatroskaDemuxContext *matroska, } memcpy(track->audio.buf + y*w, data, w); } else { - if (size < sps * w / sps) { + if (size < sps * w / sps || h<=0) { av_log(matroska->ctx, AV_LOG_ERROR, "Corrupt generic RM-style audio packet size\n"); return AVERROR_INVALIDDATA; -- cgit v1.2.3