dcstr: fix division by zero
authorAndreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Thu, 20 Oct 2016 18:13:54 +0000 (20:13 +0200)
committerAndreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Sat, 26 Nov 2016 23:38:58 +0000 (00:38 +0100)
Also check for possible overflows.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit b0a043f51b8cc3b420dc3ceaa38fe9aa344799aa)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
libavformat/dcstr.c

index 2ae61de..e9714e5 100644 (file)
@@ -33,6 +33,7 @@ static int dcstr_probe(AVProbeData *p)
 static int dcstr_read_header(AVFormatContext *s)
 {
     unsigned codec, align;
+    int mult;
     AVStream *st;
 
     st = avformat_new_stream(s, NULL);
@@ -46,7 +47,12 @@ static int dcstr_read_header(AVFormatContext *s)
     align                  = avio_rl32(s->pb);
     avio_skip(s->pb, 4);
     st->duration           = avio_rl32(s->pb);
-    st->codec->channels   *= avio_rl32(s->pb);
+    mult                   = avio_rl32(s->pb);
+    if (st->codec->channels <= 0 || mult <= 0 || mult > INT_MAX / st->codec->channels) {
+        av_log(s, AV_LOG_ERROR, "invalid number of channels %d x %d\n", st->codec->channels, mult);
+        return AVERROR_INVALIDDATA;
+    }
+    st->codec->channels *= mult;
     if (!align || align > INT_MAX / st->codec->channels)
         return AVERROR_INVALIDDATA;
     st->codec->block_align = align * st->codec->channels;