diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2014-01-31 17:21:32 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2014-02-23 14:43:07 +0100 |
| commit | c9b961748f79f875360d5519963d08f7972bb935 (patch) | |
| tree | 407c3c8954ca99895316c3220ed1a90d72802926 | |
| parent | a94f367424051567995829d5e4a6a04977e2ecad (diff) | |
| download | ffmpeg-c9b961748f79f875360d5519963d08f7972bb935.tar.gz | |
avformat/flac_picture: allocate buffer padding for picture
Fixes: heap array overread
Fixes: asan_heap-oob_14876d9_4706_cov_815472558_cover_art.flac
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit fff2953163ff466d5391b2f862bd2216fbe728b2)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavformat/flac_picture.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavformat/flac_picture.c b/libavformat/flac_picture.c index 12d73e488f..a58b3055c8 100644 --- a/libavformat/flac_picture.c +++ b/libavformat/flac_picture.c @@ -107,7 +107,7 @@ int ff_flac_parse_picture(AVFormatContext *s, uint8_t *buf, int buf_size) ret = AVERROR_INVALIDDATA; goto fail; } - if (!(data = av_buffer_alloc(len))) { + if (!(data = av_buffer_alloc(len + FF_INPUT_BUFFER_PADDING_SIZE))) { RETURN_ERROR(AVERROR(ENOMEM)); } if (avio_read(pb, data->data, len) != len) { |