diff options
| author | Kostya <kostya.shishkov@gmail.com> | 2011-03-15 09:19:43 +0000 |
|---|---|---|
| committer | Reinhard Tartler <siretart@tauware.de> | 2011-03-16 13:27:01 +0100 |
| commit | 18c5fe919f4b1818ebdf405812c5a2d16174688f (patch) | |
| tree | f52a57cc77f868cdb4ac801d99ef4a7d7cf89670 | |
| parent | c5898d7c1d2e6079fda3e5f5da9345a2af8cbf68 (diff) | |
| download | ffmpeg-18c5fe919f4b1818ebdf405812c5a2d16174688f.tar.gz | |
Do not attempt to decode APE file with no frames
This fixes invalid reads/writes with this sample:
http://packetstorm.linuxsecurity.com/1103-exploits/vlc105-dos.txt
(cherry picked from commit 8312e3fc9041027a33c8bc667bb99740fdf41dd5)
| -rw-r--r-- | libavformat/ape.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/libavformat/ape.c b/libavformat/ape.c index fac967879a..3031e4767b 100644 --- a/libavformat/ape.c +++ b/libavformat/ape.c @@ -335,6 +335,10 @@ static int ape_read_header(AVFormatContext * s, AVFormatParameters * ap) url_fskip(pb, ape->wavheaderlength); } + if(!ape->totalframes){ + av_log(s, AV_LOG_ERROR, "No frames in the file!\n"); + return AVERROR(EINVAL); + } if(ape->totalframes > UINT_MAX / sizeof(APEFrame)){ av_log(s, AV_LOG_ERROR, "Too many frames: %d\n", ape->totalframes); return -1; |