avformat/matroskadec: check generic audio deinterleaver sub_packet_size against frame...

Fixes use of uninitialized memory
Fixes: msan_uninit-mem_7f67d052a530_7517_nosound.mkv
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit a1ed1c2193483849df689b105bec0d26c2497999)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c
index babf4b8..cafc96e 100644 (file)
--- a/libavformat/matroskadec.c
+++ b/libavformat/matroskadec.c
@@ -2178,7 +2178,7 @@ static int matroska_parse_rm_audio(MatroskaDemuxContext *matroska,
             }
             memcpy(track->audio.buf + y*w, data, w);
         } else {
-            if (size < sps * w / sps || h<=0) {
+            if (size < sps * w / sps || h<=0 || w%sps) {
                 av_log(matroska->ctx, AV_LOG_ERROR,
                        "Corrupt generic RM-style audio packet size\n");
                 return AVERROR_INVALIDDATA;