MrBesen/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Vorbis-in-Ogg: Do not set timebase to invalid values

Browse Source 
Avoids an assert when the sample rate is invalid and the timebase
is thus set to e.g. 1/0.
Sample file is http://samples.mplayerhq.hu/ogg/fuzzed-srate-crash.ogg

This is a quick fix for a crash, not a final solution.

Signed-off-by: Mans Rullgard <mans@mansr.com>
This commit is contained in:
Reimar Döffinger 2011-01-28 23:52:50 +00:00 committed by Mans Rullgard
parent 0745116c10
commit ce20edb7bd
1 changed files with 7 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
libavformat/oggparsevorbis.c
View File

@ -221,6 +221,7 @@ vorbis_header (AVFormatContext * s, int idx)
if (os->buf[os->pstart] == 1) {
const uint8_t *p = os->buf + os->pstart + 7; /* skip "\001vorbis" tag */
unsigned blocksize, bs0, bs1;
int srate;
if (os->psize != 30)
return -1;
@ -229,7 +230,7 @@ vorbis_header (AVFormatContext * s, int idx)
return -1;
st->codec->channels = bytestream_get_byte(&p);
st->codec->sample_rate = bytestream_get_le32(&p);
srate = bytestream_get_le32(&p);
p += 4; // skip maximum bitrate
st->codec->bit_rate = bytestream_get_le32(&p); // nominal bitrate
p += 4; // skip minimum bitrate
@ -249,8 +250,11 @@ vorbis_header (AVFormatContext * s, int idx)
st->codec->codec_type = AVMEDIA_TYPE_AUDIO;
st->codec->codec_id = CODEC_ID_VORBIS;
st->time_base.num = 1;
st->time_base.den = st->codec->sample_rate;
if (srate > 0) {
st->codec->sample_rate = srate;
st->time_base.num = 1;
st->time_base.den = srate;
}
} else if (os->buf[os->pstart] == 3) {
if (os->psize > 8)
ff_vorbis_comment (s, &st->metadata, os->buf + os->pstart + 7, os->psize - 8);