mirror of
https://git.ffmpeg.org/ffmpeg.git
synced 2024-09-24 15:21:22 +00:00
avcodec/utils: Check values in apply_param_change()
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
parent
656e9a68c4
commit
e83ffb48ac
@ -2257,6 +2257,7 @@ static int apply_param_change(AVCodecContext *avctx, AVPacket *avpkt)
|
|||||||
int size = 0, ret;
|
int size = 0, ret;
|
||||||
const uint8_t *data;
|
const uint8_t *data;
|
||||||
uint32_t flags;
|
uint32_t flags;
|
||||||
|
int64_t val;
|
||||||
|
|
||||||
data = av_packet_get_side_data(avpkt, AV_PKT_DATA_PARAM_CHANGE, &size);
|
data = av_packet_get_side_data(avpkt, AV_PKT_DATA_PARAM_CHANGE, &size);
|
||||||
if (!data)
|
if (!data)
|
||||||
@ -2277,7 +2278,12 @@ static int apply_param_change(AVCodecContext *avctx, AVPacket *avpkt)
|
|||||||
if (flags & AV_SIDE_DATA_PARAM_CHANGE_CHANNEL_COUNT) {
|
if (flags & AV_SIDE_DATA_PARAM_CHANGE_CHANNEL_COUNT) {
|
||||||
if (size < 4)
|
if (size < 4)
|
||||||
goto fail;
|
goto fail;
|
||||||
avctx->channels = bytestream_get_le32(&data);
|
val = bytestream_get_le32(&data);
|
||||||
|
if (val <= 0 || val > INT_MAX) {
|
||||||
|
av_log(avctx, AV_LOG_ERROR, "Invalid channel count");
|
||||||
|
return AVERROR_INVALIDDATA;
|
||||||
|
}
|
||||||
|
avctx->channels = val;
|
||||||
size -= 4;
|
size -= 4;
|
||||||
}
|
}
|
||||||
if (flags & AV_SIDE_DATA_PARAM_CHANGE_CHANNEL_LAYOUT) {
|
if (flags & AV_SIDE_DATA_PARAM_CHANGE_CHANNEL_LAYOUT) {
|
||||||
@ -2289,7 +2295,12 @@ static int apply_param_change(AVCodecContext *avctx, AVPacket *avpkt)
|
|||||||
if (flags & AV_SIDE_DATA_PARAM_CHANGE_SAMPLE_RATE) {
|
if (flags & AV_SIDE_DATA_PARAM_CHANGE_SAMPLE_RATE) {
|
||||||
if (size < 4)
|
if (size < 4)
|
||||||
goto fail;
|
goto fail;
|
||||||
avctx->sample_rate = bytestream_get_le32(&data);
|
val = bytestream_get_le32(&data);
|
||||||
|
if (val <= 0 || val > INT_MAX) {
|
||||||
|
av_log(avctx, AV_LOG_ERROR, "Invalid sample rate");
|
||||||
|
return AVERROR_INVALIDDATA;
|
||||||
|
}
|
||||||
|
avctx->sample_rate = val;
|
||||||
size -= 4;
|
size -= 4;
|
||||||
}
|
}
|
||||||
if (flags & AV_SIDE_DATA_PARAM_CHANGE_DIMENSIONS) {
|
if (flags & AV_SIDE_DATA_PARAM_CHANGE_DIMENSIONS) {
|
||||||
|
Loading…
Reference in New Issue
Block a user