Merge commit '42d73f7f6bea0ee0f64a3ad4882860ce5b923a11'
authorMichael Niedermayer <michaelni@gmx.at>
Thu, 13 Jun 2013 09:56:31 +0000 (11:56 +0200)
committerMichael Niedermayer <michaelni@gmx.at>
Thu, 13 Jun 2013 09:56:31 +0000 (11:56 +0200)
* commit '42d73f7f6bea0ee0f64a3ad4882860ce5b923a11':
  4xm: do not overread while parsing header

Conflicts:
libavformat/4xm.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>
1  2 
libavformat/4xm.c

@@@ -224,15 -217,11 +226,16 @@@ static int fourxm_read_header(AVFormatC
      for (i = 0; i < header_size - 8; i++) {
          fourcc_tag = AV_RL32(&header[i]);
          size       = AV_RL32(&header[i + 4]);
 +        if (size > header_size - i - 8 && (fourcc_tag == vtrk_TAG || fourcc_tag == strk_TAG)) {
 +            av_log(s, AV_LOG_ERROR, "chunk larger than array %d>%d\n", size, header_size - i - 8);
 +            return AVERROR_INVALIDDATA;
 +        }
  
          if (fourcc_tag == std__TAG) {
-             if (header_size < i + 16) {
+             if (header_size - i < 16) {
 +                av_log(s, AV_LOG_ERROR, "std TAG truncated\n");
-                 return AVERROR_INVALIDDATA;
+                 ret = AVERROR_INVALIDDATA;
+                 goto fail;
              }
              fourxm->fps = av_int2float(AV_RL32(&header[i + 12]));
          } else if (fourcc_tag == vtrk_TAG) {