From: Michael Niedermayer Date: Sat, 10 May 2014 02:25:43 +0000 (+0200) Subject: avfilter/vf_lut3d: check size in parse_dat() X-Git-Tag: n2.3~1271 X-Git-Url: https://git.videolan.org/?p=ffmpeg.git;a=commitdiff_plain;h=2e55f3e90715418ffc6da70363c2bb6ab658481e avfilter/vf_lut3d: check size in parse_dat() Fixes CID1212261 Reviewed-by: Clément Bœsch Signed-off-by: Michael Niedermayer --- diff --git a/libavfilter/vf_lut3d.c b/libavfilter/vf_lut3d.c index 85e270cc5f..7b2f83f3c2 100644 --- a/libavfilter/vf_lut3d.c +++ b/libavfilter/vf_lut3d.c @@ -274,7 +274,12 @@ static int parse_dat(AVFilterContext *ctx, FILE *f) NEXT_LINE(skip_line(line)); if (!strncmp(line, "3DLUTSIZE ", 10)) { - lut3d->lutsize = size = strtol(line + 10, NULL, 0); + size = strtol(line + 10, NULL, 0); + if (size < 2 || size > MAX_LEVEL) { + av_log(ctx, AV_LOG_ERROR, "Too large or invalid 3D LUT size\n"); + return AVERROR(EINVAL); + } + lut3d->lutsize = size; NEXT_LINE(skip_line(line)); } for (k = 0; k < size; k++) {