X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavformat%2Fgenh.c;h=698104a9d61974b1917092cb0775b4b5e48b1469;hb=e3156fa7c2b85e9b8d1dfe6a92b0920624c0e65c;hp=61adf499647106752f20746eaf66cce2f035e660;hpb=47e12966b75490cfa5fb8ed65a48a9a3d84a7bce;p=ffmpeg

diff --git a/libavformat/genh.c b/libavformat/genh.c
index 61adf499647..698104a9d61 100644
--- a/libavformat/genh.c
+++ b/libavformat/genh.c
@@ -87,7 +87,9 @@ static int genh_read_header(AVFormatContext *s)
     case  5: st->codecpar->codec_id = st->codecpar->block_align > 0 ?
                                    AV_CODEC_ID_PCM_S8_PLANAR :
                                    AV_CODEC_ID_PCM_S8;           break;
-    case  6: st->codecpar->codec_id = AV_CODEC_ID_SDX2_DPCM;        break;
+    case  6: if (st->codecpar->block_align > INT_MAX/1024)
+                 return AVERROR_INVALIDDATA;
+             st->codecpar->codec_id = AV_CODEC_ID_SDX2_DPCM;        break;
     case  7: ret = ff_alloc_extradata(st->codecpar, 2);
              if (ret < 0)
                  return ret;
@@ -144,6 +146,9 @@ static int genh_read_header(AVFormatContext *s)
         }
     }
 
+    if (st->codecpar->block_align <= 0)
+        return AVERROR_INVALIDDATA;
+
     avio_skip(s->pb, start_offset - avio_tell(s->pb));
 
     avpriv_set_pts_info(st, 64, 1, st->codecpar->sample_rate);