diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2017-05-30 21:29:20 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2017-06-05 23:16:54 +0200 |
| commit | bb7df22328731af64129469e6bcfa1fe6241c6ad (patch) | |
| tree | 954fb333c69b811efd66fc175b1e74622b41b222 | |
| parent | 464288cc5ea891869e9546e1fc3ebeafc9629baa (diff) | |
| download | ffmpeg-bb7df22328731af64129469e6bcfa1fe6241c6ad.tar.gz | |
avformat/avidec: Limit formats in gab2 to srt and ass/ssa
This prevents part of one exploit leading to an information leak
Found-by: Emil Lerner and Pavel Cheremushkin
Reported-by: Thierry Foucu <tfoucu@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a5d849b149ca67ced2d271dc84db0bc95a548abb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavformat/avidec.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/libavformat/avidec.c b/libavformat/avidec.c index cbe6c85636..223ddd0530 100644 --- a/libavformat/avidec.c +++ b/libavformat/avidec.c @@ -1081,6 +1081,9 @@ static int read_gab2_sub(AVFormatContext *s, AVStream *st, AVPacket *pkt) if (!sub_demuxer) goto error; + if (strcmp(sub_demuxer->name, "srt") && strcmp(sub_demuxer->name, "ass")) + goto error; + if (!(ast->sub_ctx = avformat_alloc_context())) goto error; |