[FFmpeg-cvslog] xmv: check audio track parameters validity.

[Anton Khirnov]

ffmpeg | branch: release/0.10 | Anton Khirnov <anton at khirnov.net> | Thu Mar 28 10:33:02 2013 +0100| [9aa2eee31389696ddd4042b2f967ee02d38caeff] | committer: Reinhard Tartler

xmv: check audio track parameters validity.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable at libav.org
(cherry picked from commit d1016dccdcb10486245e5d7c186cc31af54b2a9c)

Signed-off-by: Reinhard Tartler <siretart at tauware.de>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=9aa2eee31389696ddd4042b2f967ee02d38caeff
---

 libavformat/xmv.c |   32 ++++++++++++++++++++++----------
 1 file changed, 22 insertions(+), 10 deletions(-)

diff --git a/libavformat/xmv.c b/libavformat/xmv.c
index ee4aec3..8249ce1 100644
--- a/libavformat/xmv.c
+++ b/libavformat/xmv.c
@@ -126,6 +126,16 @@ static int xmv_probe(AVProbeData *p)
     return 0;
 }
 
+static int xmv_read_close(AVFormatContext *s)
+{
+    XMVDemuxContext *xmv = s->priv_data;
+
+    av_free(xmv->audio);
+    av_free(xmv->audio_tracks);
+
+    return 0;
+}
+
 static int xmv_read_header(AVFormatContext *s,
                            AVFormatParameters *ap)
 {
@@ -136,6 +146,7 @@ static int xmv_read_header(AVFormatContext *s,
     uint32_t file_version;
     uint32_t this_packet_size;
     uint16_t audio_track;
+    int ret;
 
     avio_skip(pb, 4); /* Next packet size */
 
@@ -214,6 +225,13 @@ static int xmv_read_header(AVFormatContext *s,
             av_log(s, AV_LOG_WARNING, "Unsupported 5.1 ADPCM audio stream "
                                       "(0x%04X)\n", track->flags);
 
+        if (!track->channels || !track->sample_rate) {
+            av_log(s, AV_LOG_ERROR, "Invalid parameters for audio track %d.\n",
+                   audio_track);
+            ret = AVERROR_INVALIDDATA;
+            goto fail;
+        }
+
         ast = avformat_new_stream(s, NULL);
         if (!ast) {
             ret = AVERROR(ENOMEM);
@@ -244,6 +262,10 @@ static int xmv_read_header(AVFormatContext *s,
     xmv->stream_count       = xmv->audio_track_count + 1;
 
     return 0;
+
+fail:
+    xmv_read_close(s);
+    return ret;
 }
 
 static void xmv_read_extradata(uint8_t *extradata, AVIOContext *pb)
@@ -551,16 +573,6 @@ static int xmv_read_packet(AVFormatContext *s,
     return 0;
 }
 
-static int xmv_read_close(AVFormatContext *s)
-{
-    XMVDemuxContext *xmv = s->priv_data;
-
-    av_free(xmv->audio);
-    av_free(xmv->audio_tracks);
-
-    return 0;
-}
-
 AVInputFormat ff_xmv_demuxer = {
     .name           = "xmv",
     .long_name      = NULL_IF_CONFIG_SMALL("Microsoft XMV"),