Module: libav Branch: master Commit: ee16a0ced01e6a33b7b01a0b21a0e07c1e1c7884
Author: Kostya Shishkov <[email protected]> Committer: Luca Barbato <[email protected]> Date: Wed Jun 12 14:30:51 2013 +0200 smacker: check frame size validity Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: [email protected] Signed-off-by: Luca Barbato <[email protected]> --- libavformat/smacker.c | 6 +++++- 1 files changed, 5 insertions(+), 1 deletions(-) diff --git a/libavformat/smacker.c b/libavformat/smacker.c index 7eed34d..cd4353a 100644 --- a/libavformat/smacker.c +++ b/libavformat/smacker.c @@ -304,10 +304,14 @@ static int smacker_read_packet(AVFormatContext *s, AVPacket *pkt) /* if audio chunks are present, put them to stack and retrieve later */ for(i = 0; i < 7; i++) { if(flags & 1) { - int size; + uint32_t size; uint8_t *tmpbuf; size = avio_rl32(s->pb) - 4; + if (!size || size > frame_size) { + av_log(s, AV_LOG_ERROR, "Invalid audio part size\n"); + return AVERROR_INVALIDDATA; + } frame_size -= size; frame_size -= 4; smk->curstream++; _______________________________________________ libav-commits mailing list [email protected] https://lists.libav.org/mailman/listinfo/libav-commits
