1
0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-01-24 13:56:33 +02:00
FFmpeg/libavformat
Andreas Cadhalpun 174ec7d744 nutdec: reject negative value_len in read_sm_data
If it is negative, it can cause the byte position to move backwards in
avio_skip, which in turn makes sm_size negative and thus size larger
than the size of the packet buffer, causing invalid writes in avio_read.

Also fix potential overflow of avio_tell(bc) + value_len.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit ce10f572c12b0d172c72d31d8c979afce602bf0c)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2015-12-20 13:39:41 +01:00
..
2015-08-21 04:24:58 +00:00
2015-04-07 22:50:07 +02:00
2015-10-12 21:46:54 +02:00
2015-08-18 10:24:01 -04:00
2015-11-26 01:35:45 +01:00
2015-03-06 21:35:00 +01:00
2014-08-30 15:50:22 +00:00
2015-02-26 02:06:10 +01:00
2014-06-18 14:55:28 +02:00
2015-09-03 12:42:40 +02:00
2015-06-14 15:09:33 +02:00
2015-08-20 12:22:50 +02:00
2014-04-16 19:41:41 +02:00
2014-08-24 11:05:42 +00:00
2015-10-09 21:13:49 +02:00
2015-05-26 19:54:41 +02:00
2015-05-31 19:04:52 +02:00
2014-07-13 19:18:31 +02:00
2014-07-13 19:18:31 +02:00
2014-08-15 22:47:45 +02:00
2015-08-21 04:24:58 +00:00
2015-09-01 22:46:23 +02:00
2014-12-18 23:27:07 +01:00
2014-08-24 11:05:42 +00:00
2015-12-06 02:51:27 +01:00
2015-06-07 21:55:46 +02:00
2014-12-20 00:17:43 +01:00
2015-09-01 13:35:37 +02:00
2015-05-27 21:48:47 +02:00
2014-10-21 03:52:27 +02:00
2015-04-23 12:56:31 +02:00
2014-09-30 20:21:14 +02:00
2014-10-22 23:12:38 +02:00
2014-03-08 12:36:57 +01:00
2015-12-13 10:14:24 +01:00
2015-06-22 10:47:29 +03:00
2015-01-11 00:35:01 +01:00
2015-01-11 00:35:01 +01:00
2014-08-24 11:05:42 +00:00
2015-04-24 03:43:56 +02:00