diff options
| author | James Almer <jamrial@gmail.com> | 2017-10-28 15:29:23 -0300 |
|---|---|---|
| committer | James Almer <jamrial@gmail.com> | 2017-10-28 15:29:23 -0300 |
| commit | 220603d0c83ef1fe2727813f81bab5a96cfb046d (patch) | |
| tree | af3a004857a6ce17cf836b093ac7b170f2f14ab0 | |
| parent | eb54efc1e1aafe18d0a8a0c72a78314645bccc83 (diff) | |
| parent | 279e3aaa14daba6b7a37d75f3fb6e29c732d123f (diff) | |
| download | ffmpeg-220603d0c83ef1fe2727813f81bab5a96cfb046d.tar.gz | |
Merge commit '279e3aaa14daba6b7a37d75f3fb6e29c732d123f'
* commit '279e3aaa14daba6b7a37d75f3fb6e29c732d123f':
flv: Validate the packet size
Merged-by: James Almer <jamrial@gmail.com>
| -rw-r--r-- | libavformat/flvdec.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/libavformat/flvdec.c b/libavformat/flvdec.c index 2d89bef15f..0217cef842 100644 --- a/libavformat/flvdec.c +++ b/libavformat/flvdec.c @@ -1152,6 +1152,12 @@ retry_duration: st->codecpar->codec_id == AV_CODEC_ID_MPEG4) { int type = avio_r8(s->pb); size--; + + if (size < 0) { + ret = AVERROR_INVALIDDATA; + goto leave; + } + if (st->codecpar->codec_id == AV_CODEC_ID_H264 || st->codecpar->codec_id == AV_CODEC_ID_MPEG4) { // sign extension int32_t cts = (avio_rb24(s->pb) + 0xff800000) ^ 0xff800000; |