projects
/
platform
/
upstream
/
libav.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
| inline |
side by side
(parent:
ac3f8d3
)
ape: skip packets with invalid size
author
Justin Ruggles
<justin.ruggles@gmail.com>
Sat, 4 Feb 2012 22:08:34 +0000
(17:08 -0500)
committer
Justin Ruggles
<justin.ruggles@gmail.com>
Mon, 6 Feb 2012 18:22:01 +0000
(13:22 -0500)
libavformat/ape.c
patch
|
blob
|
history
diff --git
a/libavformat/ape.c
b/libavformat/ape.c
index
8145db3
..
4d13e48
100644
(file)
--- a/
libavformat/ape.c
+++ b/
libavformat/ape.c
@@
-379,6
+379,14
@@
static int ape_read_packet(AVFormatContext * s, AVPacket * pkt)
else
nblocks = ape->blocksperframe;
+ if (ape->frames[ape->currentframe].size <= 0 ||
+ ape->frames[ape->currentframe].size > INT_MAX - extra_size) {
+ av_log(s, AV_LOG_ERROR, "invalid packet size: %d\n",
+ ape->frames[ape->currentframe].size);
+ ape->currentframe++;
+ return AVERROR(EIO);
+ }
+
if (av_new_packet(pkt, ape->frames[ape->currentframe].size + extra_size) < 0)
return AVERROR(ENOMEM);