X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;ds=sidebyside;f=libavformat%2Fdcstr.c;h=6035dd43344cec78e209877ea41daa873b5dbd2f;hb=e7282674a505d548746a4734cbe902a9f242eb6b;hp=69fae417e82d86b5fbbf63ce4bb0fa8dec4f1bc4;hpb=0153cc49b20ac6c54d5bcd86f5ce53357e6b29aa;p=ffmpeg

diff --git a/libavformat/dcstr.c b/libavformat/dcstr.c
index 69fae417e82..6035dd43344 100644
--- a/libavformat/dcstr.c
+++ b/libavformat/dcstr.c
@@ -33,6 +33,7 @@ static int dcstr_probe(AVProbeData *p)
 static int dcstr_read_header(AVFormatContext *s)
 {
     unsigned codec, align;
+    int mult;
     AVStream *st;
 
     st = avformat_new_stream(s, NULL);
@@ -46,7 +47,12 @@ static int dcstr_read_header(AVFormatContext *s)
     align                  = avio_rl32(s->pb);
     avio_skip(s->pb, 4);
     st->duration           = avio_rl32(s->pb);
-    st->codecpar->channels   *= avio_rl32(s->pb);
+    mult                   = avio_rl32(s->pb);
+    if (st->codecpar->channels <= 0 || mult <= 0 || mult > INT_MAX / st->codecpar->channels) {
+        av_log(s, AV_LOG_ERROR, "invalid number of channels %d x %d\n", st->codecpar->channels, mult);
+        return AVERROR_INVALIDDATA;
+    }
+    st->codecpar->channels *= mult;
     if (!align || align > INT_MAX / st->codecpar->channels)
         return AVERROR_INVALIDDATA;
     st->codecpar->block_align = align * st->codecpar->channels;