diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2015-05-11 15:37:38 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2015-05-15 10:04:51 +0200 |
| commit | 889a4779eb67688ecdb66daa053e52c2dd01a41f (patch) | |
| tree | 6f001df6e291ad39d5b9aef5b0e5d7143a55e1d4 | |
| parent | a9d3baff034cd9983a9f17a12e6d9e196e1b7e9c (diff) | |
| download | ffmpeg-889a4779eb67688ecdb66daa053e52c2dd01a41f.tar.gz | |
avformat/matroskaenc: Check ff_vorbiscomment_length in put_flac_codecpriv()
Its currently guaranteed to be smaller but its safer to check anyway
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 66f26b3e8ec075298e7ba329a55893d085bafe96)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavformat/matroskaenc.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/libavformat/matroskaenc.c b/libavformat/matroskaenc.c index ec856515fa..1dfc5a8863 100644 --- a/libavformat/matroskaenc.c +++ b/libavformat/matroskaenc.c @@ -545,12 +545,15 @@ static int put_flac_codecpriv(AVFormatContext *s, "Lavf" : LIBAVFORMAT_IDENT; AVDictionary *dict = NULL; uint8_t buf[32], *data, *p; - int len; + int64_t len; snprintf(buf, sizeof(buf), "0x%"PRIx64, codec->channel_layout); av_dict_set(&dict, "WAVEFORMATEXTENSIBLE_CHANNEL_MASK", buf, 0); len = ff_vorbiscomment_length(dict, vendor); + if (len >= ((1<<24) - 4)) + return AVERROR(EINVAL); + data = av_malloc(len + 4); if (!data) { av_dict_free(&dict); |