diff options
| author | Kostya Shishkov <kostya.shishkov@gmail.com> | 2011-03-15 20:37:37 +0100 |
|---|---|---|
| committer | Carl Eugen Hoyos <cehoyos@ag.or.at> | 2011-03-15 20:37:37 +0100 |
| commit | 1c31b26bdf66879a46a7a3e340da815c1b2125a8 (patch) | |
| tree | 2a72bfe7e42cfd8683ac458403605ae8408f2e5e | |
| parent | 6947b0c42e0649f0c8355442d1732d642e467902 (diff) | |
| download | ffmpeg-1c31b26bdf66879a46a7a3e340da815c1b2125a8.tar.gz | |
Do not attempt to decode APE file with no frames.
This fixes invalid reads/writes with this sample:
http://packetstorm.linuxsecurity.com/1103-exploits/vlc105-dos.txt
| -rw-r--r-- | libavformat/ape.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/libavformat/ape.c b/libavformat/ape.c index 2de47ef483..187c9865a4 100644 --- a/libavformat/ape.c +++ b/libavformat/ape.c @@ -242,6 +242,10 @@ static int ape_read_header(AVFormatContext * s, AVFormatParameters * ap) avio_seek(pb, ape->wavheaderlength, SEEK_CUR); } + if(!ape->totalframes){ + av_log(s, AV_LOG_ERROR, "No frames in the file!\n"); + return AVERROR(EINVAL); + } if(ape->totalframes > UINT_MAX / sizeof(APEFrame)){ av_log(s, AV_LOG_ERROR, "Too many frames: %d\n", ape->totalframes); return -1; |