Browse code

rmdec: validate block alignment

This fixes division by zero crashes.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>

Andreas Cadhalpun authored on 2016/11/18 06:46:40
Showing 1 changed files
... ...
@@ -934,6 +934,10 @@ ff_rm_parse_packet (AVFormatContext *s, AVIOContext *pb,
934 934
 
935 935
              ast->sub_packet_cnt = 0;
936 936
              rm->audio_stream_num = st->index;
937
+            if (st->codecpar->block_align <= 0) {
938
+                av_log(s, AV_LOG_ERROR, "Invalid block alignment %d\n", st->codecpar->block_align);
939
+                return AVERROR_INVALIDDATA;
940
+            }
937 941
              rm->audio_pkt_cnt = h * w / st->codecpar->block_align;
938 942
         } else if ((ast->deint_id == DEINT_ID_VBRF) ||
939 943
                    (ast->deint_id == DEINT_ID_VBRS)) {