diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2017-05-30 21:29:20 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2017-05-31 02:45:14 +0200 |
| commit | 794bcc6eca21a4ac64a282a4150036426e641f7b (patch) | |
| tree | e571bf3a2774cc225b66d7dff16df2205327a20f | |
| parent | c82db1441159617c3d779335a357364a9c6ee496 (diff) | |
| download | ffmpeg-794bcc6eca21a4ac64a282a4150036426e641f7b.tar.gz | |
avformat/avidec: Limit formats in gab2 to srt and ass/ssa
This prevents part of one exploit leading to an information leak
Found-by: Emil Lerner and Pavel Cheremushkin
Reported-by: Thierry Foucu <tfoucu@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a5d849b149ca67ced2d271dc84db0bc95a548abb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavformat/avidec.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/libavformat/avidec.c b/libavformat/avidec.c index 955b27b857..1a9563aed4 100644 --- a/libavformat/avidec.c +++ b/libavformat/avidec.c @@ -1085,6 +1085,9 @@ static int read_gab2_sub(AVFormatContext *s, AVStream *st, AVPacket *pkt) if (!sub_demuxer) goto error; + if (strcmp(sub_demuxer->name, "srt") && strcmp(sub_demuxer->name, "ass")) + goto error; + if (!(ast->sub_ctx = avformat_alloc_context())) goto error; |