Unified · Split
| @@ -619,6 +619,11 @@ int lsx_aiffstartwrite(sox_format_t * ft) · 618 unmodified lines | ||
| 619 | 619 | At 48 kHz, 16 bits stereo, this gives ~3 hours of audio. |
| 620 | 620 | Sorry, the AIFF format does not provide for an indefinite |
| 621 | 621 | number of samples. */ |
| 622 | + if (ft->signal.channels >= (0x7f000000 / (ft->encoding.bits_per_sample >> 3))) | |
| 623 | + { | |
| 624 | + lsx_fail_errno(ft, SOX_EOF, "too many channels for AIFF header"); | |
| 625 | + return SOX_EOF; | |
| 626 | + } | |
| 622 | 627 | return(aiffwriteheader(ft, (uint64_t) 0x7f000000 / ((ft->encoding.bits_per_sample>>3)*ft->signal.channels))); |
| 623 | 628 | } |
| 624 | 629 | |
| @@ -19,6 +19,7 @@ · 18 unmodified lines | ||
| 19 | 19 | */ |
| 20 | 20 | |
| 21 | 21 | #include "sox_i.h" |
| 22 | +#include <limits.h> | |
| 22 | 23 | #include <string.h> |
| 23 | 24 | #include <sys/stat.h> |
| 24 | 25 | #include <stdarg.h> |
| @@ -60,9 +61,14 @@ int lsx_check_read_params(sox_format_t * ft, unsigned channels, · 35 unmodified lines | ||
| 60 | 61 | if (ft->seekable) |
| 61 | 62 | ft->data_start = lsx_tell(ft); |
| 62 | 63 | |
| 63 | − if (channels && ft->signal.channels && ft->signal.channels != channels) | |
| 64 | + if (channels && ft->signal.channels && ft->signal.channels != channels) { | |
| 64 | 65 | lsx_warn("`%s': overriding number of channels", ft->filename); |
| 65 | − else ft->signal.channels = channels; | |
| 66 | + } else if (channels > SHRT_MAX) { | |
| 67 | + lsx_fail_errno(ft, EINVAL, "implausibly large number of channels"); | |
| 68 | + return SOX_EOF; | |
| 69 | + } else { | |
| 70 | + ft->signal.channels = channels; | |
| 71 | + } | |
| 66 | 72 | |
| 67 | 73 | if (rate && ft->signal.rate && ft->signal.rate != rate) |
| 68 | 74 | lsx_warn("`%s': overriding sample rate", ft->filename); |