Skip to content
Permalink
Browse files Browse the repository at this point in the history
Do not attempt to decode APE file with no frames
This fixes invalid reads/writes with this sample:
http://packetstorm.linuxsecurity.com/1103-exploits/vlc105-dos.txt
  • Loading branch information
Kostya authored and Reinhard Tartler committed Mar 16, 2011
1 parent 1dac4d5 commit 8312e3f
Showing 1 changed file with 4 additions and 0 deletions.
4 changes: 4 additions & 0 deletions libavformat/ape.c
Expand Up @@ -242,6 +242,10 @@ static int ape_read_header(AVFormatContext * s, AVFormatParameters * ap)
avio_seek(pb, ape->wavheaderlength, SEEK_CUR);
}

if(!ape->totalframes){
av_log(s, AV_LOG_ERROR, "No frames in the file!\n");
return AVERROR(EINVAL);
}
if(ape->totalframes > UINT_MAX / sizeof(APEFrame)){
av_log(s, AV_LOG_ERROR, "Too many frames: %d\n", ape->totalframes);
return -1;
Expand Down

0 comments on commit 8312e3f

Please sign in to comment.