diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2024-05-23 01:43:42 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2024-06-01 18:01:27 +0200 |
| commit | 2f04cb673cb394b6e1cda160af8faa733b62bae2 (patch) | |
| tree | db70e7bd35dcac7785b916430a31ccb2a27daaed | |
| parent | 6f52b64bcc345842a88a40ddf3873559f1160e34 (diff) | |
| download | ffmpeg-2f04cb673cb394b6e1cda160af8faa733b62bae2.tar.gz | |
avformat/ac4dec: Check remaining space in ac4_probe()
Fixes: CID1538298 Untrusted loop bound
Fixes: undefined behavior
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavformat/ac4dec.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/libavformat/ac4dec.c b/libavformat/ac4dec.c index f647f557cc..dc6638de3a 100644 --- a/libavformat/ac4dec.c +++ b/libavformat/ac4dec.c @@ -43,6 +43,8 @@ static int ac4_probe(const AVProbeData *p) size += 4; if (buf[1] == 0x41) size += 2; + if (left < size) + break; max_frames++; left -= size; buf += size; |