bfi: Add some very basic sanity checks for input packet sizes
authorMartin Storsjö <martin@martin.st>
Sat, 28 Sep 2013 20:46:04 +0000 (23:46 +0300)
committerMartin Storsjö <martin@martin.st>
Sun, 29 Sep 2013 16:59:32 +0000 (19:59 +0300)
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
libavformat/bfi.c

index 5d7ccb8..19060e7 100644 (file)
@@ -132,6 +132,10 @@ static int bfi_read_packet(AVFormatContext * s, AVPacket * pkt)
         video_offset    = avio_rl32(pb);
         audio_size      = video_offset - audio_offset;
         bfi->video_size = chunk_size - video_offset;
+        if (audio_size < 0 || bfi->video_size < 0) {
+            av_log(s, AV_LOG_ERROR, "Invalid audio/video offsets or chunk size\n");
+            return AVERROR_INVALIDDATA;
+        }
 
         //Tossing an audio packet at the audio decoder.
         ret = av_get_packet(pb, pkt, audio_size);