From: Michael Niedermayer <michaelni@gmx.at>
Date: Wed, 12 Dec 2012 10:20:55 +0000 (+0100)
Subject: oggspeexparse: fix array overread
X-Git-Tag: android-x86-4.4-r1~7279
X-Git-Url: http://git.osdn.net/view?a=commitdiff_plain;h=a0f659b27575de81549e524d13457554b9095ac8;p=android-x86%2Fexternal-ffmpeg.git

oggspeexparse: fix array overread

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
---

diff --git a/libavformat/oggparsespeex.c b/libavformat/oggparsespeex.c
index 42480a3a27..63e6370482 100644
--- a/libavformat/oggparsespeex.c
+++ b/libavformat/oggparsespeex.c
@@ -58,6 +58,11 @@ static int speex_header(AVFormatContext *s, int idx) {
         st->codec->codec_type = AVMEDIA_TYPE_AUDIO;
         st->codec->codec_id = AV_CODEC_ID_SPEEX;
 
+        if (os->psize < 68) {
+            av_log(s, AV_LOG_ERROR, "speex packet too small\n");
+            return AVERROR_INVALIDDATA;
+        }
+
         st->codec->sample_rate = AV_RL32(p + 36);
         st->codec->channels = AV_RL32(p + 48);
         if (st->codec->channels < 1 || st->codec->channels > 2) {