diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2024-06-07 01:50:00 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2024-07-02 21:57:24 +0200 |
| commit | 0d0373de3bc6aa6fa5c71247191afccfaf20723d (patch) | |
| tree | cf97347470e8abb84c301ab1265d78e53c93900b | |
| parent | ca237a841e9e78ac02694124d81ff78c74b0bf72 (diff) | |
| download | ffmpeg-0d0373de3bc6aa6fa5c71247191afccfaf20723d.tar.gz | |
avformat/rdt: Check pkt_len
Fixes: CID1473553 Untrusted loop bound
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavformat/rdt.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/libavformat/rdt.c b/libavformat/rdt.c index 60449d256a..2fa53d34a8 100644 --- a/libavformat/rdt.c +++ b/libavformat/rdt.c @@ -206,6 +206,8 @@ ff_rdt_parse_header(const uint8_t *buf, int len, return -1; /* not followed by a data packet */ pkt_len = AV_RB16(buf+3); + if (pkt_len > len) + return AVERROR_INVALIDDATA; buf += pkt_len; len -= pkt_len; consumed += pkt_len; |