diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2017-05-30 21:29:20 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2017-06-18 16:05:23 +0200 |
| commit | 39c729c375a67eb87d420e2079a003af6f0c7bf2 (patch) | |
| tree | 524e84ce40c1a42ddc9ce66b6c63bed9d9ceeb8f | |
| parent | 276eae8adc95c83ef0717376142af2e2f5b55d17 (diff) | |
| download | ffmpeg-39c729c375a67eb87d420e2079a003af6f0c7bf2.tar.gz | |
avformat/avidec: Limit formats in gab2 to srt and ass/ssa
This prevents part of one exploit leading to an information leak
Found-by: Emil Lerner and Pavel Cheremushkin
Reported-by: Thierry Foucu <tfoucu@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a5d849b149ca67ced2d271dc84db0bc95a548abb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavformat/avidec.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/libavformat/avidec.c b/libavformat/avidec.c index ebb21bd937..65193289c4 100644 --- a/libavformat/avidec.c +++ b/libavformat/avidec.c @@ -1088,6 +1088,9 @@ static int read_gab2_sub(AVFormatContext *s, AVStream *st, AVPacket *pkt) if (!sub_demuxer) goto error; + if (strcmp(sub_demuxer->name, "srt") && strcmp(sub_demuxer->name, "ass")) + goto error; + if (!(ast->sub_ctx = avformat_alloc_context())) goto error; |