Do not attempt to decode APE file with no frames
authorKostya <kostya.shishkov@gmail.com>
Tue, 15 Mar 2011 09:19:43 +0000 (09:19 +0000)
committerReinhard Tartler <siretart@tauware.de>
Wed, 16 Mar 2011 12:27:01 +0000 (13:27 +0100)
This fixes invalid reads/writes with this sample:
http://packetstorm.linuxsecurity.com/1103-exploits/vlc105-dos.txt
(cherry picked from commit 8312e3fc9041027a33c8bc667bb99740fdf41dd5)

libavformat/ape.c

index fac9678..3031e47 100644 (file)
@@ -335,6 +335,10 @@ static int ape_read_header(AVFormatContext * s, AVFormatParameters * ap)
             url_fskip(pb, ape->wavheaderlength);
     }
 
+    if(!ape->totalframes){
+        av_log(s, AV_LOG_ERROR, "No frames in the file!\n");
+        return AVERROR(EINVAL);
+    }
     if(ape->totalframes > UINT_MAX / sizeof(APEFrame)){
         av_log(s, AV_LOG_ERROR, "Too many frames: %d\n", ape->totalframes);
         return -1;