diff options
| author | Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com> | 2016-01-02 16:27:02 +0100 |
|---|---|---|
| committer | Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com> | 2016-01-03 21:13:01 +0100 |
| commit | 40eb2531b279abe008012c5c2c292552d3e62449 (patch) | |
| tree | 4684dc84d09824658303f24f74304ed755e65fb8 | |
| parent | 43ff4aed26cba2cce230972add631ab938d33b30 (diff) | |
| download | ffmpeg-40eb2531b279abe008012c5c2c292552d3e62449.tar.gz | |
ffmdec: reset packet_end in case of failure
This fixes segmentation faults caused by passing a packet_ptr of NULL to
memcpy.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
| -rw-r--r-- | libavformat/ffmdec.c | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/libavformat/ffmdec.c b/libavformat/ffmdec.c index ecb4229c71..f754895986 100644 --- a/libavformat/ffmdec.c +++ b/libavformat/ffmdec.c @@ -124,9 +124,10 @@ static int ffm_read_data(AVFormatContext *s, ffm->dts = avio_rb64(pb); frame_offset = avio_rb16(pb); avio_read(pb, ffm->packet, ffm->packet_size - FFM_HEADER_SIZE); - ffm->packet_end = ffm->packet + (ffm->packet_size - FFM_HEADER_SIZE - fill_size); - if (ffm->packet_end < ffm->packet || frame_offset < 0) + if (ffm->packet_size < FFM_HEADER_SIZE + fill_size || frame_offset < 0) { return -1; + } + ffm->packet_end = ffm->packet + (ffm->packet_size - FFM_HEADER_SIZE - fill_size); /* if first packet or resynchronization packet, we must handle it specifically */ if (ffm->first_packet || (frame_offset & 0x8000)) { @@ -142,8 +143,10 @@ static int ffm_read_data(AVFormatContext *s, return 0; } ffm->first_packet = 0; - if ((frame_offset & 0x7fff) < FFM_HEADER_SIZE) + if ((frame_offset & 0x7fff) < FFM_HEADER_SIZE) { + ffm->packet_end = ffm->packet_ptr; return -1; + } ffm->packet_ptr = ffm->packet + (frame_offset & 0x7fff) - FFM_HEADER_SIZE; if (!header) break; |