[FFmpeg-cvslog] boadec: prevent overflow during block alignment calculation

[Andreas Cadhalpun]

ffmpeg | branch: master | Andreas Cadhalpun <Andreas.Cadhalpun at googlemail.com> | Thu Jan 26 01:19:02 2017 +0100| [9ec8790ac4787d3d514c5fa27b66d581614fd1be] | committer: Andreas Cadhalpun

boadec: prevent overflow during block alignment calculation

Reviewed-by: Michael Niedermayer <michael at niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun at googlemail.com>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=9ec8790ac4787d3d514c5fa27b66d581614fd1be
---

 libavformat/boadec.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/libavformat/boadec.c b/libavformat/boadec.c
index ac2a33b..6055eff 100644
--- a/libavformat/boadec.c
+++ b/libavformat/boadec.c
@@ -20,6 +20,7 @@
  */
 
 #include "libavutil/intreadwrite.h"
+#include "libavcodec/internal.h"
 #include "avformat.h"
 #include "internal.h"
 
@@ -53,9 +54,20 @@ static int read_header(AVFormatContext *s)
     avio_rl32(s->pb);
     st->codecpar->sample_rate = avio_rl32(s->pb);
     st->codecpar->channels    = avio_rl32(s->pb);
+    if (st->codecpar->channels > FF_SANE_NB_CHANNELS) {
+        av_log(s, AV_LOG_ERROR, "Too many channels %d > %d\n",
+               st->codecpar->channels, FF_SANE_NB_CHANNELS);
+        return AVERROR(ENOSYS);
+    }
     s->internal->data_offset = avio_rl32(s->pb);
     avio_r8(s->pb);
-    st->codecpar->block_align = st->codecpar->channels * avio_rl32(s->pb);
+    st->codecpar->block_align = avio_rl32(s->pb);
+    if (st->codecpar->block_align > INT_MAX / FF_SANE_NB_CHANNELS) {
+        av_log(s, AV_LOG_ERROR, "Too large block alignment %d > %d\n",
+               st->codecpar->block_align, INT_MAX / FF_SANE_NB_CHANNELS);
+        return AVERROR_INVALIDDATA;
+    }
+    st->codecpar->block_align *= st->codecpar->channels;
 
     avio_seek(s->pb, s->internal->data_offset, SEEK_SET);