Skip to content
Permalink
Browse files

Do not attempt to decode APE file with no frames

This fixes invalid reads/writes with this sample:
http://packetstorm.linuxsecurity.com/1103-exploits/vlc105-dos.txt
  • Loading branch information...
Kostya Reinhard Tartler
Kostya authored and Reinhard Tartler committed Mar 15, 2011
1 parent 1dac4d5 commit 8312e3fc9041027a33c8bc667bb99740fdf41dd5
Showing with 4 additions and 0 deletions.
  1. +4 −0 libavformat/ape.c
@@ -242,6 +242,10 @@ static int ape_read_header(AVFormatContext * s, AVFormatParameters * ap)
avio_seek(pb, ape->wavheaderlength, SEEK_CUR);
}

if(!ape->totalframes){
av_log(s, AV_LOG_ERROR, "No frames in the file!\n");
return AVERROR(EINVAL);
}
if(ape->totalframes > UINT_MAX / sizeof(APEFrame)){
av_log(s, AV_LOG_ERROR, "Too many frames: %d\n", ape->totalframes);
return -1;

0 comments on commit 8312e3f

Please sign in to comment.
You can’t perform that action at this time.