}
}
-int ff_get_wav_header(AVIOContext *pb, AVCodecContext *codec, int size)
+int ff_get_wav_header(AVFormatContext *s, AVIOContext *pb,
+ AVCodecContext *codec, int size)
{
int id;
+ uint64_t bitrate;
+
+ if (size < 14)
+ return AVERROR_INVALIDDATA;
id = avio_rl16(pb);
codec->codec_type = AVMEDIA_TYPE_AUDIO;
codec->channels = avio_rl16(pb);
codec->sample_rate = avio_rl32(pb);
- codec->bit_rate = avio_rl32(pb) * 8;
+ bitrate = avio_rl32(pb) * 8;
codec->block_align = avio_rl16(pb);
if (size == 14) { /* We're dealing with plain vanilla WAVEFORMAT */
codec->bits_per_coded_sample = 8;
if (cbSize > 0) {
av_free(codec->extradata);
codec->extradata = av_mallocz(codec->extradata_size +
- FF_INPUT_BUFFER_PADDING_SIZE);
+ AV_INPUT_BUFFER_PADDING_SIZE);
if (!codec->extradata)
return AVERROR(ENOMEM);
avio_read(pb, codec->extradata, codec->extradata_size);
if (size > 0)
avio_skip(pb, size);
}
+
+ if (bitrate > INT_MAX) {
+ if (s->error_recognition & AV_EF_EXPLODE) {
+ av_log(s, AV_LOG_ERROR,
+ "The bitrate %"PRIu64" is too large.\n",
+ bitrate);
+ return AVERROR_INVALIDDATA;
+ } else {
+ av_log(s, AV_LOG_WARNING,
+ "The bitrate %"PRIu64" is too large, resetting to 0.",
+ bitrate);
+ codec->bit_rate = 0;
+ }
+ } else {
+ codec->bit_rate = bitrate;
+ }
+
+ if (codec->sample_rate <= 0) {
+ av_log(s, AV_LOG_ERROR,
+ "Invalid sample rate: %d\n", codec->sample_rate);
+ return AVERROR_INVALIDDATA;
+ }
if (codec->codec_id == AV_CODEC_ID_AAC_LATM) {
/* Channels and sample_rate values are those prior to applying SBR
* and/or PS. */