diff options
| author | Martin Storsjö <martin@martin.st> | 2013-09-11 14:54:05 +0300 |
|---|---|---|
| committer | Luca Barbato <lu_zero@gentoo.org> | 2014-01-07 09:43:56 +0100 |
| commit | 7981b5c20e614e792967f17d09cf1adfb07ae254 (patch) | |
| tree | 6a580e886c48c9bea8335a98ce30b905b81fd207 | |
| parent | 9291012d52a7eddda1ffa32c46d3fb6f1953b11e (diff) | |
| download | ffmpeg-7981b5c20e614e792967f17d09cf1adfb07ae254.tar.gz | |
omadec: Properly check lengths before incrementing the position
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 342c43d154e586bc022c86b168fe8d36f69da9d3)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit 9eba02d5dd7036294ea350cb772822deec95b867)
| -rw-r--r-- | libavformat/omadec.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/libavformat/omadec.c b/libavformat/omadec.c index 9e8b43b3c5..98ba1c5e35 100644 --- a/libavformat/omadec.c +++ b/libavformat/omadec.c @@ -170,7 +170,11 @@ static int nprobe(AVFormatContext *s, uint8_t *enc_header, unsigned size, taglen = AV_RB32(&enc_header[pos+32]); datalen = AV_RB32(&enc_header[pos+36]) >> 4; - pos += 44 + taglen; + pos += 44; + if (size - pos < taglen) + return -1; + + pos += taglen; if (datalen << 4 > size - pos) return -1; |