diff options
| author | softworkz <softworkz@hotmail.com> | 2025-04-20 01:18:09 +0200 |
|---|---|---|
| committer | softworkz <softworkz@hotmail.com> | 2025-05-03 07:57:15 +0200 |
| commit | 26429eee22d6b2ccb9b45747975b34806398a33c (patch) | |
| tree | 00a1fe4e5606b88d98571d1d03e04b2a30e54574 | |
| parent | 1a083a4d90bc4cf26f06d3f62d75da3d49afcf39 (diff) | |
| download | ffmpeg-26429eee22d6b2ccb9b45747975b34806398a33c.tar.gz | |
libavformat/asfdec: Fix regression bug when reading image attachments
Commit c8140fe7324f264faacf7395b27e12531d1f13f7 had introduced
a check for value_len > UINT16_MAX.
As a consequence, attached images of sizes larger than UINT16_MAX
could no longer be read.
This is a minimal fix of the regression, avoiding the controversies
of my earlier submission regarding int type handling in asfdec.
Signed-off-by: softworkz <softworkz@hotmail.com>
| -rw-r--r-- | libavformat/asfdec_f.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/libavformat/asfdec_f.c b/libavformat/asfdec_f.c index 2441cadb44..ea6e8ef4f3 100644 --- a/libavformat/asfdec_f.c +++ b/libavformat/asfdec_f.c @@ -608,7 +608,8 @@ static int asf_read_metadata(AVFormatContext *s) { AVIOContext *pb = s->pb; ASFContext *asf = s->priv_data; - int n, stream_num, name_len_utf16, name_len_utf8, value_len; + int n, stream_num, name_len_utf16, name_len_utf8; + unsigned int value_len; int ret, i; n = avio_rl16(pb); @@ -622,7 +623,7 @@ static int asf_read_metadata(AVFormatContext *s) value_type = avio_rl16(pb); /* value_type */ value_len = avio_rl32(pb); - if (value_len < 0 || value_len > UINT16_MAX) + if (value_len >= (INT_MAX - LEN) / 2) return AVERROR_INVALIDDATA; name_len_utf8 = 2*name_len_utf16 + 1; |