projects
/
platform
/
upstream
/
libav.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
| inline |
side by side
(parent:
1a5fdf9
)
alsdec: check block length
author
Reinhard Tartler
<siretart@tauware.de>
Sun, 8 Dec 2013 18:24:26 +0000
(13:24 -0500)
committer
Reinhard Tartler
<siretart@tauware.de>
Tue, 10 Dec 2013 12:21:40 +0000
(07:21 -0500)
Fix writing over the end
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Addresses: CVE-2013-0845
libavcodec/alsdec.c
patch
|
blob
|
history
diff --git
a/libavcodec/alsdec.c
b/libavcodec/alsdec.c
index
782a1b8
..
f7dee7d
100644
(file)
--- a/
libavcodec/alsdec.c
+++ b/
libavcodec/alsdec.c
@@
-1376,6
+1376,11
@@
static int read_frame_data(ALSDecContext *ctx, unsigned int ra_frame)
for (b = 0; b < ctx->num_blocks; b++) {
bd.block_length = div_blocks[b];
+ if (bd.block_length <= 0) {
+ av_log(ctx->avctx, AV_LOG_WARNING,
+ "Invalid block length %d in channel data!\n", bd.block_length);
+ continue;
+ }
for (c = 0; c < avctx->channels; c++) {
bd.const_block = ctx->const_block + c;