Do not attempt to decode APE file with no frames

Message ID 20110315101943.GA25849@kst-acer
State Committed
Commit 8312e3fc9041027a33c8bc667bb99740fdf41dd5
Headers show

Commit Message

Kostya Shishkov March 15, 2011, 10:19 a.m.
This fixes invalid reads/writes with this sample:
http://packetstorm.linuxsecurity.com/1103-exploits/vlc105-dos.txt

---
 libavformat/ape.c |    4 ++++
 1 files changed, 4 insertions(+), 0 deletions(-)

Comments

Benjamin Larsson March 15, 2011, 10:20 a.m. | #1
On 03/15/2011 11:19 AM, Kostya Shishkov wrote:
> This fixes invalid reads/writes with this sample:
> http://packetstorm.linuxsecurity.com/1103-exploits/vlc105-dos.txt
>
> ---
>  libavformat/ape.c |    4 ++++
>  1 files changed, 4 insertions(+), 0 deletions(-)
>
> diff --git a/libavformat/ape.c b/libavformat/ape.c
> index 6c26984..dd2aeb9 100644
> --- a/libavformat/ape.c
> +++ b/libavformat/ape.c
> @@ -242,6 +242,10 @@ static int ape_read_header(AVFormatContext * s, AVFormatParameters * ap)
>              avio_seek(pb, ape->wavheaderlength, SEEK_CUR);
>      }
>  
> +    if(!ape->totalframes){
> +        av_log(s, AV_LOG_ERROR, "No frames in the file!\n");
> +        return AVERROR(EINVAL);
> +    }
>      if(ape->totalframes > UINT_MAX / sizeof(APEFrame)){
>          av_log(s, AV_LOG_ERROR, "Too many frames: %d\n", ape->totalframes);
>          return -1;

OK.

MvH
Benjamin Larsson

Patch

diff --git a/libavformat/ape.c b/libavformat/ape.c
index 6c26984..dd2aeb9 100644
--- a/libavformat/ape.c
+++ b/libavformat/ape.c
@@ -242,6 +242,10 @@  static int ape_read_header(AVFormatContext * s, AVFormatParameters * ap)
             avio_seek(pb, ape->wavheaderlength, SEEK_CUR);
     }
 
+    if(!ape->totalframes){
+        av_log(s, AV_LOG_ERROR, "No frames in the file!\n");
+        return AVERROR(EINVAL);
+    }
     if(ape->totalframes > UINT_MAX / sizeof(APEFrame)){
         av_log(s, AV_LOG_ERROR, "Too many frames: %d\n", ape->totalframes);
         return -1;