This fixes feeding unitialized data in some cases on corrupted/fuzzed files.
Unified · Split
| @@ -1969,12 +1969,16 @@ static int demux_mkv_open_audio(demuxer_t *demuxer, mkv_track_t *track) · 1968 unmodified lines | |||
| 1969 | if (flavor >= MP_ARRAY_SIZE(atrc_fl2bps)) | 1969 | if (flavor >= MP_ARRAY_SIZE(atrc_fl2bps)) |
| 1970 | goto error; | 1970 | goto error; |
| 1971 | sh_a->bitrate = atrc_fl2bps[flavor] * 8; | 1971 | sh_a->bitrate = atrc_fl2bps[flavor] * 8; |
| 1972 | if (!track->sub_packet_size || track->audiopk_size % track->sub_packet_size) | ||
| 1973 | goto error; | ||
| 1972 | sh_a->block_align = track->sub_packet_size; | 1974 | sh_a->block_align = track->sub_packet_size; |
| 1973 | } else if (!strcmp(track->codec_id, "A_REAL/COOK")) { | 1975 | } else if (!strcmp(track->codec_id, "A_REAL/COOK")) { |
| 1974 | sh_a->codec = "cook"; | 1976 | sh_a->codec = "cook"; |
| 1975 | if (flavor >= MP_ARRAY_SIZE(cook_fl2bps)) | 1977 | if (flavor >= MP_ARRAY_SIZE(cook_fl2bps)) |
| 1976 | goto error; | 1978 | goto error; |
| 1977 | sh_a->bitrate = cook_fl2bps[flavor] * 8; | 1979 | sh_a->bitrate = cook_fl2bps[flavor] * 8; |
| 1980 | if (!track->sub_packet_size || track->audiopk_size % track->sub_packet_size) | ||
| 1981 | goto error; | ||
| 1978 | sh_a->block_align = track->sub_packet_size; | 1982 | sh_a->block_align = track->sub_packet_size; |
| 1979 | } else if (!strcmp(track->codec_id, "A_REAL/SIPR")) { | 1983 | } else if (!strcmp(track->codec_id, "A_REAL/SIPR")) { |
| 1980 | sh_a->codec = "sipr"; | 1984 | sh_a->codec = "sipr"; |
| @@ -1985,6 +1989,10 @@ static int demux_mkv_open_audio(demuxer_t *demuxer, mkv_track_t *track) · 4 unmodified lines | |||
| 1985 | } else if (!strcmp(track->codec_id, "A_REAL/28_8")) { | 1989 | } else if (!strcmp(track->codec_id, "A_REAL/28_8")) { |
| 1986 | sh_a->codec = "ra_288"; | 1990 | sh_a->codec = "ra_288"; |
| 1987 | sh_a->bitrate = 3600 * 8; | 1991 | sh_a->bitrate = 3600 * 8; |
| 1992 | if (track->sub_packet_h & 1) | ||
| 1993 | goto error; | ||
| 1994 | if (2 * track->audiopk_size != (int64_t)track->sub_packet_h * track->coded_framesize) | ||
| 1995 | goto error; | ||
| 1988 | sh_a->block_align = track->coded_framesize; | 1996 | sh_a->block_align = track->coded_framesize; |
| 1989 | } else if (!strcmp(track->codec_id, "A_REAL/DNET")) { | 1997 | } else if (!strcmp(track->codec_id, "A_REAL/DNET")) { |
| 1990 | sh_a->codec = "ac3"; | 1998 | sh_a->codec = "ac3"; |