diff options
| author | Martin Storsjö <martin@martin.st> | 2013-09-19 16:55:13 +0300 |
|---|---|---|
| committer | Luca Barbato <lu_zero@gentoo.org> | 2014-01-07 09:43:57 +0100 |
| commit | f23b1cc7d979ab0153d203e2e7ecb0ca48e78abb (patch) | |
| tree | 2347200bd9e3f24b8bff17237074f5b82a4612f6 | |
| parent | e80071892b14a66b8730dfe21aca76e5b0333f2d (diff) | |
| download | ffmpeg-f23b1cc7d979ab0153d203e2e7ecb0ca48e78abb.tar.gz | |
wtv: Add more sanity checks for a length read from the file
Also make sure the existing length check can't overflow.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 83c285f88016b087c2f0f4b9ef356ad8ef12d947)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit 78dc022f6f8a8b87773a209e0fcbea2d5b48396f)
| -rw-r--r-- | libavformat/wtv.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/libavformat/wtv.c b/libavformat/wtv.c index 2d5d7c5cbd..7a668439f9 100644 --- a/libavformat/wtv.c +++ b/libavformat/wtv.c @@ -273,7 +273,12 @@ static AVIOContext * wtvfile_open2(AVFormatContext *s, const uint8_t *buf, int b dir_length = AV_RL16(buf + 16); file_length = AV_RL64(buf + 24); name_size = 2 * AV_RL32(buf + 32); - if (buf + 48 + name_size > buf_end) { + if (name_size < 0) { + av_log(s, AV_LOG_ERROR, + "bad filename length, remaining directory entries ignored\n"); + break; + } + if (48 + name_size > buf_end - buf) { av_log(s, AV_LOG_ERROR, "filename exceeds buffer size; remaining directory entries ignored\n"); break; } |