diff options
| author | Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com> | 2015-12-02 22:47:12 +0100 |
|---|---|---|
| committer | Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com> | 2015-12-17 21:19:19 +0100 |
| commit | e56d32203289e579959f4097ad67d8305a952d7b (patch) | |
| tree | 9c7349ba3a784f399d79068d2b38d18b1add6cf6 | |
| parent | 3ffc22443579c761caec43a650db198cf165a04c (diff) | |
| download | ffmpeg-e56d32203289e579959f4097ad67d8305a952d7b.tar.gz | |
ffmdec: reject zero-sized chunks
If size is zero, avio_get_str fails, leaving the buffer uninitialized.
This causes invalid reads in av_set_options_string.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit a611375db532c3d5363d97b10fadd0211811a4fd)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
| -rw-r--r-- | libavformat/ffmdec.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libavformat/ffmdec.c b/libavformat/ffmdec.c index 9b50c9f5a6..0c5865c9cf 100644 --- a/libavformat/ffmdec.c +++ b/libavformat/ffmdec.c @@ -414,7 +414,7 @@ static int ffm2_read_header(AVFormatContext *s) } break; case MKBETAG('S', '2', 'V', 'I'): - if (f_stvi++) { + if (f_stvi++ || !size) { ret = AVERROR(EINVAL); goto fail; } @@ -429,7 +429,7 @@ static int ffm2_read_header(AVFormatContext *s) goto fail; break; case MKBETAG('S', '2', 'A', 'U'): - if (f_stau++) { + if (f_stau++ || !size) { ret = AVERROR(EINVAL); goto fail; } |