diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2015-05-11 15:37:38 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2015-06-01 23:25:20 +0200 |
| commit | c0ca9773a7024911fd50d6e3d66cbfa68a95ecc5 (patch) | |
| tree | ddd073c39e082c72a5df078c7cd95585912e5824 | |
| parent | 9193fd9ddfa44b282a9d18fdd3f934176254f0b2 (diff) | |
| download | ffmpeg-c0ca9773a7024911fd50d6e3d66cbfa68a95ecc5.tar.gz | |
avformat/matroskaenc: Check ff_vorbiscomment_length in put_flac_codecpriv()
Its currently guaranteed to be smaller but its safer to check anyway
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 66f26b3e8ec075298e7ba329a55893d085bafe96)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavformat/matroskaenc.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/libavformat/matroskaenc.c b/libavformat/matroskaenc.c index e6230f95c7..395df0f413 100644 --- a/libavformat/matroskaenc.c +++ b/libavformat/matroskaenc.c @@ -543,12 +543,15 @@ static int put_flac_codecpriv(AVFormatContext *s, "Lavf" : LIBAVFORMAT_IDENT; AVDictionary *dict = NULL; uint8_t buf[32], *data, *p; - int len; + int64_t len; snprintf(buf, sizeof(buf), "0x%"PRIx64, codec->channel_layout); av_dict_set(&dict, "WAVEFORMATEXTENSIBLE_CHANNEL_MASK", buf, 0); len = ff_vorbiscomment_length(dict, vendor); + if (len >= ((1<<24) - 4)) + return AVERROR(EINVAL); + data = av_malloc(len + 4); if (!data) { av_dict_free(&dict); |