From: Marton Balint <cus@passwd.hu>
Date: Tue, 9 Feb 2021 23:15:00 +0000 (+0100)
Subject: avdevice/pulse_audio_dec: query actual fragment size
X-Git-Url: https://git.sesse.net/?a=commitdiff_plain;h=104aa921c96f126c49259c946e995679cec3abd6;p=ffmpeg

avdevice/pulse_audio_dec: query actual fragment size

Signed-off-by: Marton Balint <cus@passwd.hu>
---

diff --git a/libavdevice/pulse_audio_dec.c b/libavdevice/pulse_audio_dec.c
index 50a3c971aee..6dea332bebe 100644
--- a/libavdevice/pulse_audio_dec.c
+++ b/libavdevice/pulse_audio_dec.c
@@ -149,6 +149,7 @@ static av_cold int pulse_read_header(AVFormatContext *s)
 
     pa_buffer_attr attr = { -1 };
     pa_channel_map cmap;
+    const pa_buffer_attr *queried_attr;
 
     pa_channel_map_init_extend(&cmap, pd->channels, PA_CHANNEL_MAP_WAVEEX);
 
@@ -242,6 +243,14 @@ static av_cold int pulse_read_header(AVFormatContext *s)
         pa_threaded_mainloop_wait(pd->mainloop);
     }
 
+    /* Query actual fragment size */
+    queried_attr = pa_stream_get_buffer_attr(pd->stream);
+    if (!queried_attr || queried_attr->fragsize > INT_MAX/100) {
+        ret = AVERROR_EXTERNAL;
+        goto unlock_and_fail;
+    }
+    pd->fragment_size = queried_attr->fragsize;
+
     pa_threaded_mainloop_unlock(pd->mainloop);
 
     /* take real parameters */