Check mp3 header before calling avpriv_mpegaudio_decode_header().

As indicated in the function documentation, the header MUST be checked prior to calling it because no consistency check is done there. CC:[email protected]
zhengxj91 · Jun 23, 2014 · f2f2e76 · f2f2e76
1 parent 4412754
commit f2f2e76
Show file tree

Hide file tree

Showing 2 changed files with 17 additions and 8 deletions.
diff --git a/libavcodec/libmp3lame.c b/libavcodec/libmp3lame.c
@@ -182,6 +182,7 @@ static int mp3lame_encode_frame(AVCodecContext *avctx, AVPacket *avpkt,
  MPADecodeHeader hdr;
  int len, ret, ch;
  int lame_result;
+ uint32_t h;
 
  if (frame) {
  switch (avctx->sample_fmt) {
@@ -237,7 +238,12 @@ static int mp3lame_encode_frame(AVCodecContext *avctx, AVPacket *avpkt,
  determine the frame size. */
  if (s->buffer_index < 4)
  return 0;
- if (avpriv_mpegaudio_decode_header(&hdr, AV_RB32(s->buffer))) {
+ h = AV_RB32(s->buffer);
+ if (ff_mpa_check_header(h) < 0) {
+ av_log(avctx, AV_LOG_ERROR, "Invalid mp3 header at start of buffer\n");
+ return AVERROR_BUG;
+ }
+ if (avpriv_mpegaudio_decode_header(&hdr, h)) {
  av_log(avctx, AV_LOG_ERROR, "free format output not supported\n");
  return -1;
  }

diff --git a/libavformat/mp3enc.c b/libavformat/mp3enc.c
@@ -252,13 +252,16 @@ static int mp3_write_audio_packet(AVFormatContext *s, AVPacket *pkt)
 
  if (mp3->xing_offset && pkt->size >= 4) {
  MPADecodeHeader c;
-
- avpriv_mpegaudio_decode_header(&c, AV_RB32(pkt->data));
-
- if (!mp3->initial_bitrate)
- mp3->initial_bitrate = c.bit_rate;
- if ((c.bit_rate == 0) || (mp3->initial_bitrate != c.bit_rate))
- mp3->has_variable_bitrate = 1;
+ uint32_t h;
+
+ h = AV_RB32(pkt->data);
+ if (ff_mpa_check_header(h) == 0) {
+ avpriv_mpegaudio_decode_header(&c, h);
+ if (!mp3->initial_bitrate)
+ mp3->initial_bitrate = c.bit_rate;
+ if ((c.bit_rate == 0) || (mp3->initial_bitrate != c.bit_rate))
+ mp3->has_variable_bitrate = 1;
+ }
 
  mp3_xing_add_frame(mp3, pkt);
  }