epafdec: prevent overflow during block alignment calculation

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>

diff --git a/libavformat/epafdec.c b/libavformat/epafdec.c
index 29190fff720e6eb1bf911bd5939ff34ddf86937d..0cd9627a4b220b8baa3369574b945183032e3190 100644 (file)
--- a/libavformat/epafdec.c
+++ b/libavformat/epafdec.c
@@ -20,6 +20,7 @@
  */
 
 #include "libavutil/intreadwrite.h"
+#include "libavcodec/internal.h"
 #include "avformat.h"
 #include "internal.h"
 #include "pcm.h"
@@ -59,7 +60,7 @@ static int epaf_read_header(AVFormatContext *s)
         channels    = avio_rb32(s->pb);
     }
 
-    if (!channels || !sample_rate)
+    if (channels <= 0 || channels > FF_SANE_NB_CHANNELS || sample_rate <= 0)
         return AVERROR_INVALIDDATA;
 
     st = avformat_new_stream(s, NULL);