aboutsummaryrefslogtreecommitdiffstats
path: root/libavcodec/alac.c
diff options
context:
space:
mode:
authorMichael Niedermayer <michaelni@gmx.at>2012-11-10 17:41:56 +0100
committerMichael Niedermayer <michaelni@gmx.at>2012-11-10 17:42:35 +0100
commit3920d1387834e2bc334aff9f518f4beb24e470bd (patch)
treed02477a82aa0514be91d8bd20462011f88de20c4 /libavcodec/alac.c
parentfd4f4923cce6a2cbf4f48640b4ac706e614a1594 (diff)
downloadandroid_external_ffmpeg-3920d1387834e2bc334aff9f518f4beb24e470bd.tar.gz
android_external_ffmpeg-3920d1387834e2bc334aff9f518f4beb24e470bd.tar.bz2
android_external_ffmpeg-3920d1387834e2bc334aff9f518f4beb24e470bd.zip
alac: fix integer overflow leading to subsequent out of array accesses.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/alac.c')
-rw-r--r--libavcodec/alac.c6
1 files changed, 5 insertions, 1 deletions
diff --git a/libavcodec/alac.c b/libavcodec/alac.c
index f032ceb9cc..46c3a5b37b 100644
--- a/libavcodec/alac.c
+++ b/libavcodec/alac.c
@@ -542,7 +542,11 @@ static av_cold int alac_decode_close(AVCodecContext *avctx)
static int allocate_buffers(ALACContext *alac)
{
int ch;
- int buf_size = alac->max_samples_per_frame * sizeof(int32_t);
+ int buf_size;
+
+ if (alac->max_samples_per_frame > INT_MAX / sizeof(int32_t))
+ goto buf_alloc_fail;
+ buf_size = alac->max_samples_per_frame * sizeof(int32_t);
for (ch = 0; ch < FFMIN(alac->channels, 2); ch++) {
FF_ALLOC_OR_GOTO(alac->avctx, alac->predict_error_buffer[ch],