diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2015-05-12 18:03:55 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2015-05-15 10:04:51 +0200 |
| commit | bd05ac1df8d2cf9c8639702b9afd59e805e51ec9 (patch) | |
| tree | c28a7fc33af1a9905180fc4a37b545288fc942e6 | |
| parent | 8d0f079c45a3ce410095730f8f3f4853079b96c8 (diff) | |
| download | ffmpeg-bd05ac1df8d2cf9c8639702b9afd59e805e51ec9.tar.gz | |
avformat/rtpdec_xiph: Check upper bound on len in xiph_handle_packet()
Larger packets are not supported and would cause problems later
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit aa5169935e160551fb1c290d1397da2f04325817)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavformat/rtpdec_xiph.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavformat/rtpdec_xiph.c b/libavformat/rtpdec_xiph.c index a09653f340..8492865b4f 100644 --- a/libavformat/rtpdec_xiph.c +++ b/libavformat/rtpdec_xiph.c @@ -88,7 +88,7 @@ static int xiph_handle_packet(AVFormatContext *ctx, PayloadContext *data, return data->split_pkts > 0; } - if (len < 6) { + if (len < 6 || len > INT_MAX/2) { av_log(ctx, AV_LOG_ERROR, "Invalid %d byte packet\n", len); return AVERROR_INVALIDDATA; } |