X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavformat%2Fboadec.c;h=730e9573d5a30c8af64b6d3c19f55c1df6198556;hb=a63496cc882428aefafc85d2f60e0908b020bffe;hp=ac2a33b3f0a1e2ff5704d1619ceb919c173aa1b0;hpb=6ace05beec179d9c370fc404b678db3873af7531;p=ffmpeg

diff --git a/libavformat/boadec.c b/libavformat/boadec.c
index ac2a33b3f0a..730e9573d5a 100644
--- a/libavformat/boadec.c
+++ b/libavformat/boadec.c
@@ -20,6 +20,7 @@
  */
 
 #include "libavutil/intreadwrite.h"
+#include "libavcodec/internal.h"
 #include "avformat.h"
 #include "internal.h"
 
@@ -53,9 +54,14 @@ static int read_header(AVFormatContext *s)
     avio_rl32(s->pb);
     st->codecpar->sample_rate = avio_rl32(s->pb);
     st->codecpar->channels    = avio_rl32(s->pb);
+    if (st->codecpar->channels > FF_SANE_NB_CHANNELS)
+        return AVERROR(ENOSYS);
     s->internal->data_offset = avio_rl32(s->pb);
     avio_r8(s->pb);
-    st->codecpar->block_align = st->codecpar->channels * avio_rl32(s->pb);
+    st->codecpar->block_align = avio_rl32(s->pb);
+    if (st->codecpar->block_align > INT_MAX / FF_SANE_NB_CHANNELS)
+        return AVERROR_INVALIDDATA;
+    st->codecpar->block_align *= st->codecpar->channels;
 
     avio_seek(s->pb, s->internal->data_offset, SEEK_SET);