avidec: Check that the header chunks fit in the available filesize.
authorMichael Niedermayer <michaelni@gmx.at>
Fri, 16 Dec 2011 05:13:04 +0000 (06:13 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Fri, 16 Dec 2011 05:13:04 +0000 (06:13 +0100)
Fixes Ticket771
Bug found by: Diana Elena Muscalu

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavformat/avidec.c

index 05f5d58..ec543d7 100644 (file)
@@ -387,6 +387,11 @@ static int avi_read_header(AVFormatContext *s, AVFormatParameters *ap)
         tag = avio_rl32(pb);
         size = avio_rl32(pb);
 
+        if(size > avi->fsize){
+            av_log(s, AV_LOG_ERROR, "chunk size is too big during header parsing\n");
+            goto fail;
+        }
+
         print_tag("tag", tag, size);
 
         switch(tag) {