virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-05-29 21:47:48 +02:00
Code Issues Releases Activity

libavformat/asfdec: Fix regression bug when reading image attachments

Browse Source 
Commit c8140fe7324f264faacf7395b27e12531d1f13f7 had introduced
a check for value_len > UINT16_MAX.
As a consequence, attached images of sizes larger than UINT16_MAX
could no longer be read.

This is a minimal fix of the regression, avoiding the controversies
of my earlier submission regarding int type handling in asfdec.

Signed-off-by: softworkz <softworkz@hotmail.com>
This commit is contained in:
softworkz 2025-04-20 01:18:09 +02:00
parent 1a083a4d90
commit 26429eee22
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
libavformat/asfdec_f.c
View File

@ -608,7 +608,8 @@ static int asf_read_metadata(AVFormatContext *s)
{
AVIOContext *pb = s->pb;
ASFContext *asf = s->priv_data;
int n, stream_num, name_len_utf16, name_len_utf8, value_len;
int n, stream_num, name_len_utf16, name_len_utf8;
unsigned int value_len;
int ret, i;
n = avio_rl16(pb);
@ -622,7 +623,7 @@ static int asf_read_metadata(AVFormatContext *s)
value_type = avio_rl16(pb); /* value_type */
value_len = avio_rl32(pb);
if (value_len < 0 || value_len > UINT16_MAX)
if (value_len >= (INT_MAX - LEN) / 2)
return AVERROR_INVALIDDATA;
name_len_utf8 = 2*name_len_utf16 + 1;