diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-11-22 19:47:34 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-11-22 19:49:25 +0100 |
| commit | 2e97e244097c309571b383dd107252404ebb3326 (patch) | |
| tree | c3531447fd3c4e61ff4363b3c357bd372a9677eb | |
| parent | e4eb2c957b68df097db700082af2320d31e5b340 (diff) | |
| download | ffmpeg-2e97e244097c309571b383dd107252404ebb3326.tar.gz | |
avformat/ipmovie: check OPCODE_INIT_VIDEO_BUFFERS size more completely
Fixes use of uninitialized data
Fixes: signal_sigsegv_1571228_5930_ipmovie_interplayvideo_interplay_dpcm__bislogo.mve
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavformat/ipmovie.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavformat/ipmovie.c b/libavformat/ipmovie.c index 676363b628..368c05922d 100644 --- a/libavformat/ipmovie.c +++ b/libavformat/ipmovie.c @@ -376,7 +376,7 @@ static int process_ipmovie_chunk(IPMVEContext *s, AVIOContext *pb, case OPCODE_INIT_VIDEO_BUFFERS: av_dlog(NULL, "initialize video buffers\n"); - if ((opcode_version > 2) || (opcode_size > 8)) { + if ((opcode_version > 2) || (opcode_size > 8) || opcode_size < 4) { av_dlog(NULL, "bad init_video_buffers opcode\n"); chunk_type = CHUNK_BAD; break; |