diff options
| author | Katerina Barone-Adesi <katerinab@gmail.com> | 2014-09-16 01:40:24 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2014-09-17 21:38:31 +0200 |
| commit | 70dc7bb893db63e7c8d8592e4730b69af20f6be4 (patch) | |
| tree | 1d58d927052c53ccaaa1921375111c56380fa1ec | |
| parent | b9b97900c19c9bddd74d495aaa320af1924bf7ce (diff) | |
| download | ffmpeg-70dc7bb893db63e7c8d8592e4730b69af20f6be4.tar.gz | |
apetag: Fix APE tag size check
The size variable is (correctly) unsigned, but is passed to several functions
which take signed parameters, such as avio_read, sometimes after having
numbers added to it. So ensure that size remains within the bounds that
these functions can handle.
CC: libav-stable@libav.org
Signed-off-by: Diego Biurrun <diego@biurrun.de>
(cherry picked from commit c5560e72d0bb69f8a1ac9536570398f84388f396)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavformat/apetag.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/libavformat/apetag.c b/libavformat/apetag.c index a445c84aef..6f5f7bd5d0 100644 --- a/libavformat/apetag.c +++ b/libavformat/apetag.c @@ -51,8 +51,10 @@ static int ape_tag_read_field(AVFormatContext *s) av_log(s, AV_LOG_WARNING, "Invalid APE tag key '%s'.\n", key); return -1; } - if (size >= UINT_MAX) - return -1; + if (size > INT32_MAX - FF_INPUT_BUFFER_PADDING_SIZE) { + av_log(s, AV_LOG_ERROR, "APE tag size too large.\n"); + return AVERROR_INVALIDDATA; + } if (flags & APE_TAG_FLAG_IS_BINARY) { uint8_t filename[1024]; enum AVCodecID id; |