virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2026-05-16 08:38:24 +02:00
Code Issues Releases Activity

asfdec: add more checks for size left in asf packet buffer

Browse Source 
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit c0a49077ea)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
This commit is contained in:
Alexandra Hájková
2015-09-07 12:18:17 +02:00
committed by Andreas Cadhalpun
parent f235f511a0
commit 8118fdf8bb
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libavformat/asfdec_o.c
+4 -2
View File
@@ -1141,7 +1141,7 @@ static int asf_read_replicated_data(AVFormatContext *s, ASFPacket *asf_pkt)
if (!asf_pkt->data_size) {
asf_pkt->data_size = asf_pkt->size_left = avio_rl32(pb); // read media object size
if (asf_pkt->data_size <= 0)
return AVERROR_EOF;
return AVERROR_INVALIDDATA;
if ((ret = av_new_packet(&asf_pkt->avpkt, asf_pkt->data_size)) < 0)
return ret;
} else
@@ -1190,6 +1190,8 @@ static int asf_read_multiple_payload(AVFormatContext *s, AVPacket *pkt,
skip = pay_len - asf_pkt->size_left;
pay_len = asf_pkt->size_left;
}
if (asf_pkt->size_left <= 0)
return AVERROR_INVALIDDATA;
if ((ret = avio_read(pb, p, pay_len)) < 0)
return ret;
if (s->key && s->keylen == 20)
@@ -1237,7 +1239,7 @@ static int asf_read_single_payload(AVFormatContext *s, AVPacket *pkt,
return AVERROR_INVALIDDATA;
}
p = asf_pkt->avpkt.data + asf_pkt->data_size - asf_pkt->size_left;
if (size > asf_pkt->size_left)
if (size > asf_pkt->size_left || asf_pkt->size_left <= 0)
return AVERROR_INVALIDDATA;
if (asf_pkt->size_left > size)
asf_pkt->size_left -= size;