Skip to content
Permalink
Browse files Browse the repository at this point in the history
avformat/movenc: Write version 2 of audio atom if channels is not known
The version 1 needs the channel count and would divide by 0
Fixes: division by 0
Fixes: fpe_movenc.c_1108_1.ogg
Fixes: fpe_movenc.c_1108_2.ogg
Fixes: fpe_movenc.c_1108_3.wav

Found-by: #CHEN HONGXU# <HCHEN017@e.ntu.edu.sg>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
  • Loading branch information
michaelni committed Jul 9, 2018
1 parent 6cc6b61 commit fa19fbc
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion libavformat/movenc.c
Expand Up @@ -1022,7 +1022,7 @@ static int mov_write_audio_tag(AVFormatContext *s, AVIOContext *pb, MOVMuxContex
uint32_t tag = track->tag;

if (track->mode == MODE_MOV) {
if (track->timescale > UINT16_MAX) {
if (track->timescale > UINT16_MAX || !track->par->channels) {
if (mov_get_lpcm_flags(track->par->codec_id))
tag = AV_RL32("lpcm");
version = 2;
Expand Down

1 comment on commit fa19fbc

@hongxuchen
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Asssigned to CVE-2018-14395 .

Please sign in to comment.