From: Kostya Shishkov <kostya.shishkov@gmail.com>
Date: Wed, 12 Jun 2013 12:30:51 +0000 (+0200)
Subject: smacker: check frame size validity
X-Git-Tag: v10_alpha1~1315
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=ee16a0ced01e6a33b7b01a0b21a0e07c1e1c7884;p=platform%2Fupstream%2Flibav.git

smacker: check frame size validity

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
---

diff --git a/libavformat/smacker.c b/libavformat/smacker.c
index 7eed34d..cd4353a 100644
--- a/libavformat/smacker.c
+++ b/libavformat/smacker.c
@@ -304,10 +304,14 @@ static int smacker_read_packet(AVFormatContext *s, AVPacket *pkt)
         /* if audio chunks are present, put them to stack and retrieve later */
         for(i = 0; i < 7; i++) {
             if(flags & 1) {
-                int size;
+                uint32_t size;
                 uint8_t *tmpbuf;
 
                 size = avio_rl32(s->pb) - 4;
+                if (!size || size > frame_size) {
+                    av_log(s, AV_LOG_ERROR, "Invalid audio part size\n");
+                    return AVERROR_INVALIDDATA;
+                }
                 frame_size -= size;
                 frame_size -= 4;
                 smk->curstream++;