diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-12-27 11:45:55 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2014-01-21 16:42:32 +0100 |
| commit | d35916f6ea4964410073797d9ef73c1410d12b81 (patch) | |
| tree | 51b5f3f33178e80f56022bcbec52251ff9804d98 | |
| parent | 94e2673f4e455df61073b0ed4e46545149b5f8ce (diff) | |
| download | ffmpeg-d35916f6ea4964410073797d9ef73c1410d12b81.tar.gz | |
avformat/mpegts: check sl.timestamp_len
Fixes: msan_uninit-mem_7ff4404547ba_4883_dmbts.ts
Fixes assertion failure
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e630ca5111077fa8adc972fe8a3d7e2b3e8dc91f)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavformat/mpegts.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/libavformat/mpegts.c b/libavformat/mpegts.c index fe4ac35878..4c0c14e0bf 100644 --- a/libavformat/mpegts.c +++ b/libavformat/mpegts.c @@ -1222,6 +1222,11 @@ static int parse_MP4SLDescrTag(MP4DescrParseContext *d, int64_t off, int len) descr->sl.timestamp_res = avio_rb32(&d->pb); avio_rb32(&d->pb); descr->sl.timestamp_len = avio_r8(&d->pb); + if (descr->sl.timestamp_len > 64) { + avpriv_request_sample(NULL, "timestamp_len > 64"); + descr->sl.timestamp_len = 64; + return AVERROR_PATCHWELCOME; + } descr->sl.ocr_len = avio_r8(&d->pb); descr->sl.au_len = avio_r8(&d->pb); descr->sl.inst_bitrate_len = avio_r8(&d->pb); |