aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorRonald S. Bultje <rsbultje@gmail.com>2012-05-04 16:06:26 -0700
committerReinhard Tartler <siretart@tauware.de>2012-06-03 19:05:29 +0200
commitec27262c4d2d428d492e27f301a01dbf9656bd7f (patch)
tree4cbf3a5806d277d51627243b37e8a65afb17e9e2
parentd34e9e61dd619a14e3d29760f6bc8cd5b1a19d9f (diff)
downloadffmpeg-ec27262c4d2d428d492e27f301a01dbf9656bd7f.tar.gz
ea: check chunk_size for validity.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-stable@libav.org (cherry picked from commit 273e6af47b38391f2bcc157cca0423fe7fcbf55c) Signed-off-by: Reinhard Tartler <siretart@tauware.de>
-rw-r--r--libavformat/electronicarts.c7
1 files changed, 6 insertions, 1 deletions
diff --git a/libavformat/electronicarts.c b/libavformat/electronicarts.c
index 01ba479fac..0113683ee2 100644
--- a/libavformat/electronicarts.c
+++ b/libavformat/electronicarts.c
@@ -474,12 +474,17 @@ static int ea_read_packet(AVFormatContext *s,
while (!packet_read) {
chunk_type = avio_rl32(pb);
- chunk_size = (ea->big_endian ? avio_rb32(pb) : avio_rl32(pb)) - 8;
+ chunk_size = ea->big_endian ? avio_rb32(pb) : avio_rl32(pb);
+ if (chunk_size <= 8)
+ return AVERROR_INVALIDDATA;
+ chunk_size -= 8;
switch (chunk_type) {
/* audio data */
case ISNh_TAG:
/* header chunk also contains data; skip over the header portion*/
+ if (chunk_size < 32)
+ return AVERROR_INVALIDDATA;
avio_skip(pb, 32);
chunk_size -= 32;
case ISNd_TAG: