From 29fa517d40ed485a24128d005ee796f0355398e1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Martin=20Storsj=C3=B6?= Date: Thu, 19 Sep 2013 17:02:36 +0300 Subject: [PATCH] r3d: Add more input value validation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-stable@libav.org Signed-off-by: Martin Storsjö Conflicts: libavformat/r3d.c --- libavformat/r3d.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libavformat/r3d.c b/libavformat/r3d.c index 73e73986ff..877c901748 100644 --- a/libavformat/r3d.c +++ b/libavformat/r3d.c @@ -277,6 +277,10 @@ static int r3d_read_reda(AVFormatContext *s, AVPacket *pkt, Atom *atom) dts = avio_rb32(s->pb); st->codec->sample_rate = avio_rb32(s->pb); + if (st->codec->sample_rate <= 0) { + av_log(s, AV_LOG_ERROR, "Bad sample rate\n"); + return AVERROR_INVALIDDATA; + } samples = avio_rb32(s->pb);