git.videolan.org
/
ffmpeg.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
| inline |
side by side
(parent:
9e36102
)
smacker: fix integer overflow with pts_inc
author
Michael Niedermayer
<michael@niedermayer.cc>
Sun, 24 Sep 2017 10:58:42 +0000
(12:58 +0200)
committer
Sean McGovern
<gseanmcg@gmail.com>
Sun, 24 Sep 2017 10:58:42 +0000
(12:58 +0200)
Bug-Id: 1073
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Sean McGovern <gseanmcg@gmail.com>
libavformat/smacker.c
patch
|
blob
|
history
diff --git
a/libavformat/smacker.c
b/libavformat/smacker.c
index
56c909b
..
304e746
100644
(file)
--- a/
libavformat/smacker.c
+++ b/
libavformat/smacker.c
@@
-117,6
+117,11
@@
static int smacker_read_header(AVFormatContext *s)
smk->height = avio_rl32(pb);
smk->frames = avio_rl32(pb);
smk->pts_inc = (int32_t)avio_rl32(pb);
+ if (smk->pts_inc > INT_MAX / 100) {
+ av_log(s, AV_LOG_ERROR, "pts_inc %d is too large\n", smk->pts_inc);
+ return AVERROR_INVALIDDATA;
+ }
+
smk->flags = avio_rl32(pb);
if(smk->flags & SMACKER_FLAG_RING_FRAME)
smk->frames++;