ffmpeg | branch: master | Andreas Cadhalpun <andreas.cadhal...@googlemail.com> | Wed Jan 6 07:32:25 2016 +0100| [2aec600ae7af7d46a4877b5ccc263b39f05a91cb] | committer: Anton Khirnov
asfdec: reject size > INT64_MAX in asf_read_unknown Both avio_skip and detect_unknown_subobject use int64_t for the size parameter. This fixes a segmentation fault due to infinite recursion. Signed-off-by: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Signed-off-by: Alexandra Hájková <alexandra.khirn...@gmail.com> Signed-off-by: Anton Khirnov <an...@khirnov.net> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=2aec600ae7af7d46a4877b5ccc263b39f05a91cb --- libavformat/asfdec.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/libavformat/asfdec.c b/libavformat/asfdec.c index 58480dc..4fc0e3d 100644 --- a/libavformat/asfdec.c +++ b/libavformat/asfdec.c @@ -178,6 +178,9 @@ static int asf_read_unknown(AVFormatContext *s, const GUIDParseTable *g) uint64_t size = avio_rl64(pb); int ret; + if (size > INT64_MAX) + return AVERROR_INVALIDDATA; + if (asf->is_header) asf->unknown_size = size; asf->is_header = 0; _______________________________________________ ffmpeg-cvslog mailing list ffmpeg-cvslog@ffmpeg.org http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog