diff options
| author | Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com> | 2016-01-02 16:27:02 +0100 |
|---|---|---|
| committer | Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com> | 2016-01-28 02:15:49 +0100 |
| commit | 33ad09205a9f41b0ab7ec6cc628ee08e40d906be (patch) | |
| tree | e1096d9498a6a67d0c3058df95b796d16074e580 | |
| parent | 46fcc2ba55df8ac2475d6977e8e220fcd5e5f169 (diff) | |
| download | ffmpeg-33ad09205a9f41b0ab7ec6cc628ee08e40d906be.tar.gz | |
ffmdec: reset packet_end in case of failure
This fixes segmentation faults caused by passing a packet_ptr of NULL to
memcpy.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 40eb2531b279abe008012c5c2c292552d3e62449)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
| -rw-r--r-- | libavformat/ffmdec.c | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/libavformat/ffmdec.c b/libavformat/ffmdec.c index ee3e1d6ea4..9a7d3a2e71 100644 --- a/libavformat/ffmdec.c +++ b/libavformat/ffmdec.c @@ -110,9 +110,10 @@ static int ffm_read_data(AVFormatContext *s, ffm->dts = avio_rb64(pb); frame_offset = avio_rb16(pb); avio_read(pb, ffm->packet, ffm->packet_size - FFM_HEADER_SIZE); - ffm->packet_end = ffm->packet + (ffm->packet_size - FFM_HEADER_SIZE - fill_size); - if (ffm->packet_end < ffm->packet || frame_offset < 0) + if (ffm->packet_size < FFM_HEADER_SIZE + fill_size || frame_offset < 0) { return -1; + } + ffm->packet_end = ffm->packet + (ffm->packet_size - FFM_HEADER_SIZE - fill_size); /* if first packet or resynchronization packet, we must handle it specifically */ if (ffm->first_packet || (frame_offset & 0x8000)) { @@ -128,8 +129,10 @@ static int ffm_read_data(AVFormatContext *s, return 0; } ffm->first_packet = 0; - if ((frame_offset & 0x7fff) < FFM_HEADER_SIZE) + if ((frame_offset & 0x7fff) < FFM_HEADER_SIZE) { + ffm->packet_end = ffm->packet_ptr; return -1; + } ffm->packet_ptr = ffm->packet + (frame_offset & 0x7fff) - FFM_HEADER_SIZE; if (!header) break; |