diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-04-04 15:39:23 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-04-04 15:51:04 +0200 |
| commit | 3b93bea9e3cad046779b05b065d8566be303bea0 (patch) | |
| tree | ab176768ad4e140188d44b3858fa6517bc911475 | |
| parent | 115c3bc41f24185477de7e012b799e47693e3b5e (diff) | |
| download | ffmpeg-3b93bea9e3cad046779b05b065d8566be303bea0.tar.gz | |
matroskadec: Check EBML lace sizes.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavformat/matroskadec.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c index 39559b5cca..ad0401a857 100644 --- a/libavformat/matroskadec.c +++ b/libavformat/matroskadec.c @@ -2027,10 +2027,10 @@ static int matroska_parse_laces(MatroskaDemuxContext *matroska, uint8_t **buf, uint64_t num; uint64_t total; n = matroska_ebmlnum_uint(matroska, data, size, &num); - if (n < 0) { + if (n < 0 || num > INT_MAX) { av_log(matroska->ctx, AV_LOG_INFO, "EBML block data error\n"); - res = n; + res = n<0 ? n : AVERROR_INVALIDDATA; break; } data += n; @@ -2040,10 +2040,10 @@ static int matroska_parse_laces(MatroskaDemuxContext *matroska, uint8_t **buf, int64_t snum; int r; r = matroska_ebmlnum_sint(matroska, data, size, &snum); - if (r < 0) { + if (r < 0 || lace_size[n - 1] + snum > (uint64_t)INT_MAX) { av_log(matroska->ctx, AV_LOG_INFO, "EBML block data error\n"); - res = r; + res = r<0 ? r : AVERROR_INVALIDDATA; break; } data += r; |