From 6da213ce208dabda3ce1d9e8d4fb72d337fa0b3f Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Fri, 10 Jan 2014 23:10:47 +0100 Subject: [PATCH] avformat/matroskadec: check generic audio deinterleaver sub_packet_size against frame_size Fixes use of uninitialized memory Fixes: msan_uninit-mem_7f67d052a530_7517_nosound.mkv Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer (cherry picked from commit a1ed1c2193483849df689b105bec0d26c2497999) Signed-off-by: Michael Niedermayer --- libavformat/matroskadec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c index babf4b8060..cafc96edbb 100644 --- a/libavformat/matroskadec.c +++ b/libavformat/matroskadec.c @@ -2178,7 +2178,7 @@ static int matroska_parse_rm_audio(MatroskaDemuxContext *matroska, } memcpy(track->audio.buf + y*w, data, w); } else { - if (size < sps * w / sps || h<=0) { + if (size < sps * w / sps || h<=0 || w%sps) { av_log(matroska->ctx, AV_LOG_ERROR, "Corrupt generic RM-style audio packet size\n"); return AVERROR_INVALIDDATA; -- 2.11.0