aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMichael Niedermayer <michaelni@gmx.at>2015-05-11 15:34:28 +0200
committerMichael Niedermayer <michaelni@gmx.at>2015-05-21 20:43:38 +0200
commitff0f0b1e835a38dc102d766003803314b159051c (patch)
treec5f6db682a4e386a18b0766bfb54283f3c791603
parentcb1ecf08b2e7078a58a4a99991ff08b129e424d7 (diff)
downloadffmpeg-ff0f0b1e835a38dc102d766003803314b159051c.tar.gz
avformat/oggenc: Check ff_vorbiscomment_length in ogg_write_vorbiscomment()
Signed-off-by: Michael Niedermayer <michaelni@gmx.at> (cherry picked from commit 0db5b2b9f8a96298eeba7988d43c4eb44220fab3) Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
-rw-r--r--libavformat/oggenc.c6
1 files changed, 4 insertions, 2 deletions
diff --git a/libavformat/oggenc.c b/libavformat/oggenc.c
index f3413c54c9..daec4eeefb 100644
--- a/libavformat/oggenc.c
+++ b/libavformat/oggenc.c
@@ -279,16 +279,18 @@ static int ogg_buffer_data(AVFormatContext *s, AVStream *st,
return 0;
}
-static uint8_t *ogg_write_vorbiscomment(int offset, int bitexact,
+static uint8_t *ogg_write_vorbiscomment(int64_t offset, int bitexact,
int *header_len, AVDictionary **m, int framing_bit)
{
const char *vendor = bitexact ? "ffmpeg" : LIBAVFORMAT_IDENT;
- int size;
+ int64_t size;
uint8_t *p, *p0;
ff_metadata_conv(m, ff_vorbiscomment_metadata_conv, NULL);
size = offset + ff_vorbiscomment_length(*m, vendor) + framing_bit;
+ if (size > INT_MAX)
+ return NULL;
p = av_mallocz(size);
if (!p)
return NULL;