virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-04-19 09:02:26 +02:00
Code Issues Releases Activity

asfdec: add more checks for size left in asf packet buffer

Browse Source 
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
This commit is contained in:
Alexandra Hájková 2015-09-07 12:18:17 +02:00 committed by Luca Barbato
parent 1b2412f501
commit c0a49077ea
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
libavformat/asfdec.c
View File

@ -1141,7 +1141,7 @@ static int asf_read_replicated_data(AVFormatContext *s, ASFPacket *asf_pkt)
if (!asf_pkt->data_size) { if (!asf_pkt->data_size) {
asf_pkt->data_size = asf_pkt->size_left = avio_rl32(pb); // read media object size asf_pkt->data_size = asf_pkt->size_left = avio_rl32(pb); // read media object size
if (asf_pkt->data_size <= 0) if (asf_pkt->data_size <= 0)
return AVERROR_EOF; return AVERROR_INVALIDDATA;
if ((ret = av_new_packet(&asf_pkt->avpkt, asf_pkt->data_size)) < 0) if ((ret = av_new_packet(&asf_pkt->avpkt, asf_pkt->data_size)) < 0)
return ret; return ret;
} else } else
@ -1190,6 +1190,8 @@ static int asf_read_multiple_payload(AVFormatContext *s, AVPacket *pkt,
skip = pay_len - asf_pkt->size_left; skip = pay_len - asf_pkt->size_left;
pay_len = asf_pkt->size_left; pay_len = asf_pkt->size_left;
} }
if (asf_pkt->size_left <= 0)
return AVERROR_INVALIDDATA;
if ((ret = avio_read(pb, p, pay_len)) < 0) if ((ret = avio_read(pb, p, pay_len)) < 0)
return ret; return ret;
if (s->key && s->keylen == 20) if (s->key && s->keylen == 20)
@ -1237,7 +1239,7 @@ static int asf_read_single_payload(AVFormatContext *s, AVPacket *pkt,
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
} }
p = asf_pkt->avpkt.data + asf_pkt->data_size - asf_pkt->size_left; p = asf_pkt->avpkt.data + asf_pkt->data_size - asf_pkt->size_left;
if (size > asf_pkt->size_left) if (size > asf_pkt->size_left || asf_pkt->size_left <= 0)
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
if (asf_pkt->size_left > size) if (asf_pkt->size_left > size)
asf_pkt->size_left -= size; asf_pkt->size_left -= size;