diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-12-14 21:22:14 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-12-14 21:59:28 +0100 |
| commit | 892562e9218b0ae55c5ad7abb5b49bafcdc922ff (patch) | |
| tree | 9afcb79b034d36c66b06403c02d2fb1ab2f81ea6 | |
| parent | de9ea40a40d8324c44ba9c20275a788954f701d4 (diff) | |
| download | ffmpeg-892562e9218b0ae55c5ad7abb5b49bafcdc922ff.tar.gz | |
avformat/ipmovie: Check OPCODE_CREATE_TIMER size
Fixes use of uninitialized memory
Fixes: msan_uninit-mem_7f81e836ef8c_5930_ipmovie_interplayvideo_interplay_dpcm__bislogo.mve
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavformat/ipmovie.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavformat/ipmovie.c b/libavformat/ipmovie.c index ff5699a0d8..57664f1539 100644 --- a/libavformat/ipmovie.c +++ b/libavformat/ipmovie.c @@ -321,7 +321,7 @@ static int process_ipmovie_chunk(IPMVEContext *s, AVIOContext *pb, case OPCODE_CREATE_TIMER: av_dlog(NULL, "create timer\n"); - if ((opcode_version > 0) || (opcode_size > 6)) { + if ((opcode_version > 0) || (opcode_size != 6)) { av_dlog(NULL, "bad create_timer opcode\n"); chunk_type = CHUNK_BAD; break; |