From 34aeb5dbc4fe7267df5f0ebe2ec84c5a8d36a896 Mon Sep 17 00:00:00 2001 From: Andreas Cadhalpun Date: Sun, 23 Oct 2016 17:25:15 +0200 Subject: [PATCH] xmv: validate sample_rate AVCodecParameters.sample_rate is a signed integer, so XMVAudioPacket.sample_rate should be, too. A negative sample rate doesn't make sense and triggers assertions in av_rescale_rnd. Signed-off-by: Andreas Cadhalpun --- libavformat/xmv.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavformat/xmv.c b/libavformat/xmv.c index b85d0ccc431..b974e5a6e69 100644 --- a/libavformat/xmv.c +++ b/libavformat/xmv.c @@ -77,7 +77,7 @@ typedef struct XMVAudioPacket { /* Stream format properties. */ uint16_t compression; ///< The type of compression. uint16_t channels; ///< Number of channels. - uint32_t sample_rate; ///< Sampling rate. + int32_t sample_rate; ///< Sampling rate. uint16_t bits_per_sample; ///< Bits per compressed sample. uint32_t bit_rate; ///< Bits of compressed data per second. uint16_t flags; ///< Flags @@ -210,7 +210,7 @@ static int xmv_read_header(AVFormatContext *s) av_log(s, AV_LOG_WARNING, "Unsupported 5.1 ADPCM audio stream " "(0x%04X)\n", packet->flags); - if (!packet->channels || !packet->sample_rate || + if (!packet->channels || packet->sample_rate <= 0 || packet->channels >= UINT16_MAX / XMV_BLOCK_ALIGN_SIZE) { av_log(s, AV_LOG_ERROR, "Invalid parameters for audio track %"PRIu16".\n", audio_track); -- 2.39.2