diff options
| author | Baptiste Coudurier <baptiste.coudurier@gmail.com> | 2008-02-25 12:38:37 +0000 |
|---|---|---|
| committer | Baptiste Coudurier <baptiste.coudurier@gmail.com> | 2008-02-25 12:38:37 +0000 |
| commit | 9c7fd997f794d3180ef4cbde019e4827ff309988 (patch) | |
| tree | 4a2d9a1b15f2ef0d1b52f1150c2aef4803b2e727 | |
| parent | b8d3daca6277911a86793b6efdbe517a5fe21360 (diff) | |
| download | ffmpeg-9c7fd997f794d3180ef4cbde019e4827ff309988.tar.gz | |
10l, protect malloc overflow
Originally committed as revision 12205 to svn://svn.ffmpeg.org/ffmpeg/trunk
| -rw-r--r-- | libavformat/aiff.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/libavformat/aiff.c b/libavformat/aiff.c index 7ff75b6e30..1685a306b1 100644 --- a/libavformat/aiff.c +++ b/libavformat/aiff.c @@ -368,6 +368,8 @@ static int aiff_read_header(AVFormatContext *s, url_fskip(pb, size - 8); break; case MKTAG('w', 'a', 'v', 'e'): + if ((uint64_t)size > (1<<30)) + return -1; st->codec->extradata = av_mallocz(size + FF_INPUT_BUFFER_PADDING_SIZE); if (!st->codec->extradata) return AVERROR(ENOMEM); |