git.videolan.org
/
ffmpeg.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
| inline |
side by side
(parent:
7040e47
)
idcin: check for integer overflow when calling av_get_packet()
author
Justin Ruggles
<justin.ruggles@gmail.com>
Wed, 1 Aug 2012 20:10:08 +0000
(16:10 -0400)
committer
Justin Ruggles
<justin.ruggles@gmail.com>
Wed, 9 Jan 2013 19:49:06 +0000
(14:49 -0500)
chunk_size is unsigned 32-bit, but av_get_packet() takes a signed int as the
packet size.
libavformat/idcin.c
patch
|
blob
|
history
diff --git
a/libavformat/idcin.c
b/libavformat/idcin.c
index
7a0042b
..
93ba721
100644
(file)
--- a/
libavformat/idcin.c
+++ b/
libavformat/idcin.c
@@
-278,6
+278,10
@@
static int idcin_read_packet(AVFormatContext *s,
}
chunk_size = avio_rl32(pb);
+ if (chunk_size < 4 || chunk_size > INT_MAX - 4) {
+ av_log(s, AV_LOG_ERROR, "invalid chunk size: %u\n", chunk_size);
+ return AVERROR_INVALIDDATA;
+ }
/* skip the number of decoded bytes (always equal to width * height) */
avio_skip(pb, 4);
chunk_size -= 4;