diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-03-05 01:35:28 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-03-14 04:59:03 +0100 |
| commit | f719e6566c08dc1e18cf1caf07ba8c0e93cd7283 (patch) | |
| tree | 0897fdccf831adec48e778d384d00b419ceffcff | |
| parent | b9a1efa6f4d4cda20ce796614ff5b0c523df5672 (diff) | |
| download | ffmpeg-f719e6566c08dc1e18cf1caf07ba8c0e93cd7283.tar.gz | |
iff: fix integer overflow
Fixes out of array accesses
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 3dbc0ff9c3e6f6e0d08ea3d42cb33761bae084ba)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavformat/iff.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/libavformat/iff.c b/libavformat/iff.c index 0e945da7a3..ffd9231fc9 100644 --- a/libavformat/iff.c +++ b/libavformat/iff.c @@ -249,6 +249,8 @@ static int iff_read_header(AVFormatContext *s) break; case ID_CMAP: + if (data_size > INT_MAX - IFF_EXTRA_VIDEO_SIZE - FF_INPUT_BUFFER_PADDING_SIZE) + return AVERROR_INVALIDDATA; st->codec->extradata_size = data_size + IFF_EXTRA_VIDEO_SIZE; st->codec->extradata = av_malloc(data_size + IFF_EXTRA_VIDEO_SIZE + FF_INPUT_BUFFER_PADDING_SIZE); if (!st->codec->extradata) @@ -409,6 +411,7 @@ static int iff_read_header(AVFormatContext *s) if (!st->codec->extradata) return AVERROR(ENOMEM); } + av_assert0(st->codec->extradata_size >= IFF_EXTRA_VIDEO_SIZE); buf = st->codec->extradata; bytestream_put_be16(&buf, IFF_EXTRA_VIDEO_SIZE); bytestream_put_byte(&buf, iff->bitmap_compression); |