[FFmpeg-cvslog] avi: Validate sample_size

[Andreas Cadhalpun]

ffmpeg | branch: master | Andreas Cadhalpun <andreas.cadhalpun at googlemail.com> | Wed May  6 02:26:57 2015 +0200| [4d0ee4962be7e07cdc038a78008ef2e4e47e5f81] | committer: Luca Barbato

avi: Validate sample_size

And either error out or set it to 0 if it is negative.

CC: libav-stable at libav.org
Signed-off-by: Luca Barbato <lu_zero at gentoo.org>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=4d0ee4962be7e07cdc038a78008ef2e4e47e5f81
---

 libavformat/avidec.c |   17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/libavformat/avidec.c b/libavformat/avidec.c
index b317b26..4caba46 100644
--- a/libavformat/avidec.c
+++ b/libavformat/avidec.c
@@ -571,6 +571,23 @@ static int avi_read_header(AVFormatContext *s)
                 av_log(s, AV_LOG_ERROR, "unknown stream type %X\n", tag1);
                 goto fail;
             }
+
+            if (ast->sample_size < 0) {
+                if (s->error_recognition & AV_EF_EXPLODE) {
+                    av_log(s, AV_LOG_ERROR,
+                           "Invalid sample_size %d at stream %d\n",
+                           ast->sample_size,
+                           stream_index);
+                    goto fail;
+                }
+                av_log(s, AV_LOG_WARNING,
+                       "Invalid sample_size %d at stream %d "
+                       "setting it to 0\n",
+                       ast->sample_size,
+                       stream_index);
+                ast->sample_size = 0;
+            }
+
             if (ast->sample_size == 0)
                 st->duration = st->nb_frames;
             ast->frame_offset = ast->cum_len;