diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2018-08-16 12:23:20 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2018-10-23 01:44:40 +0200 |
| commit | 172bb520c98fa96129d909dc9b6c6872702571b6 (patch) | |
| tree | a3ee32ab83f3725ecd9ee716394fccf1404ce535 | |
| parent | 4babf70c7efbcc6c77839944007815e58a380ec7 (diff) | |
| download | ffmpeg-172bb520c98fa96129d909dc9b6c6872702571b6.tar.gz | |
avformat/nsvdec: Do not parse multiple NSVf
The specification states "NSV files may contain a single file header. "
Fixes: out of array access
Fixes: nsv-asan-002f473f726a0dcbd3bd53e422c4fc40b3cf3421
Found-by: Paul Ch <paulcher@icloud.com>
Tested-by: Paul Ch <paulcher@icloud.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 78d4b6bd43fc266a2ee926f0555c8782246f9445)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavformat/nsvdec.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/libavformat/nsvdec.c b/libavformat/nsvdec.c index 422e14585e..26e61507dc 100644 --- a/libavformat/nsvdec.c +++ b/libavformat/nsvdec.c @@ -177,6 +177,7 @@ typedef struct NSVContext { AVRational framerate; uint32_t *nsvs_timestamps; //DVDemuxContext* dv_demux; + int nsvf; } NSVContext; static const AVCodecTag nsv_codec_video_tags[] = { @@ -280,6 +281,12 @@ static int nsv_parse_NSVf_header(AVFormatContext *s) nsv->state = NSV_UNSYNC; /* in case we fail */ + if (nsv->nsvf) { + av_log(s, AV_LOG_TRACE, "Multiple NSVf\n"); + return 0; + } + nsv->nsvf = 1; + size = avio_rl32(pb); if (size < 28) return -1; |