diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2014-05-10 04:25:43 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2014-05-10 14:46:58 +0200 |
| commit | 2e55f3e90715418ffc6da70363c2bb6ab658481e (patch) | |
| tree | dec115584bad16d019f611fe447dd26be707fda6 | |
| parent | dc6b99d6b20e832a7d353474c2d093f8b2fb17d2 (diff) | |
| download | ffmpeg-2e55f3e90715418ffc6da70363c2bb6ab658481e.tar.gz | |
avfilter/vf_lut3d: check size in parse_dat()
Fixes CID1212261
Reviewed-by: Clément Bœsch <u@pkh.me>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavfilter/vf_lut3d.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/libavfilter/vf_lut3d.c b/libavfilter/vf_lut3d.c index 85e270cc5f..7b2f83f3c2 100644 --- a/libavfilter/vf_lut3d.c +++ b/libavfilter/vf_lut3d.c @@ -274,7 +274,12 @@ static int parse_dat(AVFilterContext *ctx, FILE *f) NEXT_LINE(skip_line(line)); if (!strncmp(line, "3DLUTSIZE ", 10)) { - lut3d->lutsize = size = strtol(line + 10, NULL, 0); + size = strtol(line + 10, NULL, 0); + if (size < 2 || size > MAX_LEVEL) { + av_log(ctx, AV_LOG_ERROR, "Too large or invalid 3D LUT size\n"); + return AVERROR(EINVAL); + } + lut3d->lutsize = size; NEXT_LINE(skip_line(line)); } for (k = 0; k < size; k++) { |