Prevent overflow on random input.
authorRonald S. Bultje <rsbultje@gmail.com>
Fri, 13 Aug 2010 20:06:18 +0000 (20:06 +0000)
committerRonald S. Bultje <rsbultje@gmail.com>
Fri, 13 Aug 2010 20:06:18 +0000 (20:06 +0000)
Originally committed as revision 24795 to svn://svn.ffmpeg.org/ffmpeg/trunk

libavformat/rtpdec_asf.c

index 56df314..db872ce 100644 (file)
@@ -230,7 +230,8 @@ static int asfrtp_parse_packet(AVFormatContext *s, PayloadContext *asf,
                 int prev_len = out_len;
                 out_len += cur_len;
                 asf->buf = av_realloc(asf->buf, out_len);
-                memcpy(asf->buf + prev_len, buf + off, cur_len);
+                memcpy(asf->buf + prev_len, buf + off,
+                       FFMIN(cur_len, len - off));
                 url_fskip(pb, cur_len);
             }
         }