diff options
| author | Luca Barbato <lu_zero@gentoo.org> | 2014-10-17 10:07:10 +0100 |
|---|---|---|
| committer | Vittorio Giovara <vittorio.giovara@gmail.com> | 2015-01-12 23:59:15 +0100 |
| commit | 608e8d8dd754199b657b439f9e722e0b45f84461 (patch) | |
| tree | f68caf7a5753b8d6501140279684ed2059413d6c | |
| parent | 4d48691622149ba5998de08a0acec85d1f4ed46a (diff) | |
| download | ffmpeg-608e8d8dd754199b657b439f9e722e0b45f84461.tar.gz | |
vf_drawtext: Do not leak the mmapped textfile
And validate its size while at it.
CC: libav-stable@libav.org
Bug-Id: CID 1244189
| -rw-r--r-- | libavfilter/vf_drawtext.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/libavfilter/vf_drawtext.c b/libavfilter/vf_drawtext.c index 892104dade..d954fdf2cd 100644 --- a/libavfilter/vf_drawtext.c +++ b/libavfilter/vf_drawtext.c @@ -398,8 +398,11 @@ static av_cold int init(AVFilterContext *ctx) return err; } - if (!(s->text = av_malloc(textbuf_size+1))) + if (textbuf_size > SIZE_MAX - 1 || + !(s->text = av_malloc(textbuf_size + 1))) { + av_file_unmap(textbuf, textbuf_size); return AVERROR(ENOMEM); + } memcpy(s->text, textbuf, textbuf_size); s->text[textbuf_size] = 0; av_file_unmap(textbuf, textbuf_size); |