diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-12-27 11:45:55 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-12-27 11:53:53 +0100 |
| commit | e630ca5111077fa8adc972fe8a3d7e2b3e8dc91f (patch) | |
| tree | 7d77d6350e75b12ac7bab4f5a346b529075b5e93 | |
| parent | f55bc96a5449179ee9b0aab6f0a4581ba1df6b62 (diff) | |
| download | ffmpeg-e630ca5111077fa8adc972fe8a3d7e2b3e8dc91f.tar.gz | |
avformat/mpegts: check sl.timestamp_len
Fixes: msan_uninit-mem_7ff4404547ba_4883_dmbts.ts
Fixes assertion failure
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavformat/mpegts.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/libavformat/mpegts.c b/libavformat/mpegts.c index 18d8d8fc11..39b1b5d552 100644 --- a/libavformat/mpegts.c +++ b/libavformat/mpegts.c @@ -1256,6 +1256,11 @@ static int parse_MP4SLDescrTag(MP4DescrParseContext *d, int64_t off, int len) descr->sl.timestamp_res = avio_rb32(&d->pb); avio_rb32(&d->pb); descr->sl.timestamp_len = avio_r8(&d->pb); + if (descr->sl.timestamp_len > 64) { + avpriv_request_sample(NULL, "timestamp_len > 64"); + descr->sl.timestamp_len = 64; + return AVERROR_PATCHWELCOME; + } descr->sl.ocr_len = avio_r8(&d->pb); descr->sl.au_len = avio_r8(&d->pb); descr->sl.inst_bitrate_len = avio_r8(&d->pb); |