[FFmpeg-devel] [PATCH] avformat/aiffdec: only read codec tag when header size is ample

[Peter Ross]

Signed-off-by: Peter Ross <pross at xvid.org>
---
 libavformat/aiffdec.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/libavformat/aiffdec.c b/libavformat/aiffdec.c
index 91ef2a4..6271c3d 100644
--- a/libavformat/aiffdec.c
+++ b/libavformat/aiffdec.c
@@ -116,13 +116,13 @@ static unsigned int get_aiff_header(AVFormatContext *s, int size,
     size -= 18;
 
     /* get codec id for AIFF-C */
-    if (version == AIFF_C_VERSION1) {
+    if (version == AIFF_C_VERSION1 && size >= 4) {
         codec->codec_tag = avio_rl32(pb);
         codec->codec_id  = ff_codec_get_id(ff_codec_aiff_tags, codec->codec_tag);
         size -= 4;
     }
 
-    if (version != AIFF_C_VERSION1 || codec->codec_id == AV_CODEC_ID_PCM_S16BE) {
+    if (version != AIFF_C_VERSION1 || size < 4 || codec->codec_id == AV_CODEC_ID_PCM_S16BE) {
         codec->codec_id = aiff_codec_get_id(codec->bits_per_coded_sample);
         codec->bits_per_coded_sample = av_get_bits_per_sample(codec->codec_id);
         aiff->block_duration = 1;
-- 
2.1.0

-- Peter
(A907 E02F A6E5 0CD2 34CD 20D2 6760 79C5 AC40 DD6B)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 181 bytes
Desc: Digital signature
URL: <https://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20150104/45673a4a/attachment.asc>