[vlc-commits] voc: fix division by zero

[Rémi Denis-Courmont]

vlc | branch: master | Rémi Denis-Courmont <remi at remlab.net> | Fri Oct 28 16:15:55 2016 +0300| [5a0122f3df98b4eb3bcd2976acf4eefca1731731] | committer: Rémi Denis-Courmont

voc: fix division by zero

If buf[3] == 0xff, i_channels wraps to 0, and i_rate triggers SIGFPE.

> http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=5a0122f3df98b4eb3bcd2976acf4eefca1731731
---

 modules/demux/voc.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/modules/demux/voc.c b/modules/demux/voc.c
index e7dbe22..adaa3b4 100644
--- a/modules/demux/voc.c
+++ b/modules/demux/voc.c
@@ -309,6 +309,8 @@ static int ReadBlockHeader( demux_t *p_demux )
             }
 
             new_fmt.i_codec = VLC_CODEC_U8;
+            if (buf[3] >= 32)
+                goto corrupt;
             new_fmt.audio.i_channels = buf[3] + 1; /* can't be nul */
             new_fmt.audio.i_rate = 256000000L /
                           ((65536L - GetWLE(buf)) * new_fmt.audio.i_channels);