[vlc-commits] voc: fix division by zero

[Rémi Denis-Courmont]

vlc/vlc-2.2 | branch: master | Rémi Denis-Courmont <remi at remlab.net> | Fri Oct 28 16:15:55 2016 +0300| [83e8b6054eef002758140e64bffbb45003c58cea] | committer: Rémi Denis-Courmont

voc: fix division by zero

If buf[3] == 0xff, i_channels wraps to 0, and i_rate triggers SIGFPE.

(cherry picked from commit 5a0122f3df98b4eb3bcd2976acf4eefca1731731)

> http://git.videolan.org/gitweb.cgi/vlc/vlc-2.2.git/?a=commit;h=83e8b6054eef002758140e64bffbb45003c58cea
---

 modules/demux/voc.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/modules/demux/voc.c b/modules/demux/voc.c
index af4f163..87b1059 100644
--- a/modules/demux/voc.c
+++ b/modules/demux/voc.c
@@ -270,6 +270,8 @@ static int ReadBlockHeader( demux_t *p_demux )
             }
 
             new_fmt.i_codec = VLC_CODEC_U8;
+            if (buf[3] >= 32)
+                goto corrupt;
             new_fmt.audio.i_channels = buf[3] + 1; /* can't be nul */
             new_fmt.audio.i_rate = 256000000L /
                           ((65536L - GetWLE(buf)) * new_fmt.audio.i_channels);