diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2014-09-18 01:04:20 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2014-09-18 01:04:25 +0200 |
| commit | ab02548c8a71adc8f049b7630ca7602dc85be062 (patch) | |
| tree | d758f9677c3ded6ff545e236411bdc1f3e4af28d | |
| parent | cc73b4f574b6c99066a0482bdfc20e6da1f400a7 (diff) | |
| parent | b45ab61b24a8f2aeafdd4451491b1b30b7875ee5 (diff) | |
| download | ffmpeg-ab02548c8a71adc8f049b7630ca7602dc85be062.tar.gz | |
Merge commit 'b45ab61b24a8f2aeafdd4451491b1b30b7875ee5' into release/2.4
* commit 'b45ab61b24a8f2aeafdd4451491b1b30b7875ee5':
apetag: Fix APE tag size check
Merged-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavformat/apetag.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/libavformat/apetag.c b/libavformat/apetag.c index 7d2f0b3222..c8d1bdca5a 100644 --- a/libavformat/apetag.c +++ b/libavformat/apetag.c @@ -55,8 +55,10 @@ static int ape_tag_read_field(AVFormatContext *s) av_log(s, AV_LOG_WARNING, "Invalid APE tag key '%s'.\n", key); return -1; } - if (size >= UINT_MAX) - return -1; + if (size > INT32_MAX - FF_INPUT_BUFFER_PADDING_SIZE) { + av_log(s, AV_LOG_ERROR, "APE tag size too large.\n"); + return AVERROR_INVALIDDATA; + } if (flags & APE_TAG_FLAG_IS_BINARY) { uint8_t filename[1024]; enum AVCodecID id; |