diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2016-12-05 17:27:45 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2016-12-06 00:59:22 +0100 |
| commit | e0cb113f9b4b7a26ac0053a483f92c26a4a90f0e (patch) | |
| tree | f4b3a592d410e51647dd041e305d25904647b96e /ffserver.c | |
| parent | 15abba737bffa3fa11f7e4fdc85b3d03d80db37e (diff) | |
| download | ffmpeg-e0cb113f9b4b7a26ac0053a483f92c26a4a90f0e.tar.gz | |
ffserver: Check chunk size
Fixes out of array access
Fixes: poc_ffserver.py
Found-by: Paul Cher <paulcher@icloud.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a5d25faa3f4b18dac737fdb35d0dd68eb0dc2156)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'ffserver.c')
| -rw-r--r-- | ffserver.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/ffserver.c b/ffserver.c index 822e729441..567f102823 100644 --- a/ffserver.c +++ b/ffserver.c @@ -2580,8 +2580,10 @@ static int http_receive_data(HTTPContext *c) } else if (c->buffer_ptr - c->buffer >= 2 && !memcmp(c->buffer_ptr - 1, "\r\n", 2)) { c->chunk_size = strtol(c->buffer, 0, 16); - if (c->chunk_size == 0) // end of stream + if (c->chunk_size <= 0) { // end of stream or invalid chunk size + c->chunk_size = 0; goto fail; + } c->buffer_ptr = c->buffer; break; } else if (++loop_run > 10) @@ -2603,6 +2605,7 @@ static int http_receive_data(HTTPContext *c) /* end of connection : close it */ goto fail; else { + av_assert0(len <= c->chunk_size); c->chunk_size -= len; c->buffer_ptr += len; c->data_count += len; |