Also make sure the existing length check can't overflow.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-sta...@libav.org
---
libavformat/wtv.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/libavformat/wtv.c b/libavformat/wtv.c
index b003905..093f795 100644
--- a/libavformat/wtv.c
+++ b/libavformat/wtv.c
@@ -269,10 +269,15 @@ static AVIOContext * wtvfile_open2(AVFormatContext *s,
const uint8_t *buf, int b
dir_length = AV_RL16(buf + 16);
file_length = AV_RL64(buf + 24);
name_size = 2 * AV_RL32(buf + 32);
- if (buf + 48 + name_size > buf_end) {
+ if (48 + name_size > buf_end - buf) {
av_log(s, AV_LOG_ERROR, "filename exceeds buffer size; remaining
directory entries ignored\n");
break;
}
+ if (name_size < 0) {
+ av_log(s, AV_LOG_ERROR,
+ "bad filename length, remaining directory entries
ignored\n");
+ break;
+ }
first_sector = AV_RL32(buf + 40 + name_size);
depth = AV_RL32(buf + 44 + name_size);
--
1.7.9.5
_______________________________________________
libav-devel mailing list
libav-devel@libav.org
https://lists.libav.org/mailman/listinfo/libav-devel
