1
0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2026-05-16 08:38:24 +02:00
Files
FFmpeg/libavformat
Andreas Cadhalpun 174ec7d744 nutdec: reject negative value_len in read_sm_data
If it is negative, it can cause the byte position to move backwards in
avio_skip, which in turn makes sm_size negative and thus size larger
than the size of the packet buffer, causing invalid writes in avio_read.

Also fix potential overflow of avio_tell(bc) + value_len.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit ce10f572c1)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2015-12-20 13:39:41 +01:00
..
2015-08-21 04:24:58 +00:00
2015-10-12 21:46:54 +02:00
2015-08-18 10:24:01 -04:00
2015-11-26 01:35:45 +01:00
2015-09-03 12:42:40 +02:00
2015-06-14 15:09:33 +02:00
2015-08-20 12:22:50 +02:00
2015-10-09 21:13:49 +02:00
2015-08-21 04:24:58 +00:00
2015-09-01 22:46:23 +02:00
2015-12-06 02:51:27 +01:00
2015-09-01 13:35:37 +02:00
2015-12-13 10:14:24 +01:00
2015-06-22 10:47:29 +03:00