MrBesen/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

avformat/rmdec: Check size in ivr_read_packet() before use

Browse Source 
Fixes out of array access
Fixes: asan_heap-oob_445b39_1741_d00eb645ab48eb2203b4a04a5b997103.ivr

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2016-01-14 23:20:58 +01:00
parent fc2588a1d6
commit 80fd348bb7
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
libavformat/rmdec.c
View File

@ -1357,6 +1357,11 @@ static int ivr_read_packet(AVFormatContext *s, AVPacket *pkt)
size = avio_rb32(pb);
avio_skip(pb, 4);
if (size < 1 || size > INT_MAX/4) {
av_log(s, AV_LOG_ERROR, "size %d is invalid\n");
return AVERROR_INVALIDDATA;
}
st = s->streams[index];
ret = ff_rm_parse_packet(s, pb, st, st->priv_data, size, pkt,
&seq, 0, pts);