aboutsummaryrefslogtreecommitdiffstats
path: root/libavcodec/flacdec.c
diff options
context:
space:
mode:
authorJustin Ruggles <justin.ruggles@gmail.com>2011-09-13 15:13:44 -0400
committerJustin Ruggles <justin.ruggles@gmail.com>2011-09-26 15:29:45 -0400
commit4c5e7b27d57dd2be777780e840eef9be63242158 (patch)
tree286899d7a921fc0aeb2897baf26ac2f58fac4b41 /libavcodec/flacdec.c
parent1430ae44e82074cc4edee508f11431a0d0fcbe12 (diff)
downloadffmpeg-4c5e7b27d57dd2be777780e840eef9be63242158.tar.gz
flacdec: fix buffer size checking in get_metadata_size()
Adds an additional check before reading the next block header and avoids a potential integer overflow when checking the metadata size against the remaining buffer size.
Diffstat (limited to 'libavcodec/flacdec.c')
-rw-r--r--libavcodec/flacdec.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/libavcodec/flacdec.c b/libavcodec/flacdec.c
index f6d0abe544..3eb117acf6 100644
--- a/libavcodec/flacdec.c
+++ b/libavcodec/flacdec.c
@@ -226,9 +226,11 @@ static int get_metadata_size(const uint8_t *buf, int buf_size)
buf += 4;
do {
+ if (buf_end - buf < 4)
+ return 0;
ff_flac_parse_block_header(buf, &metadata_last, NULL, &metadata_size);
buf += 4;
- if (buf + metadata_size > buf_end) {
+ if (buf_end - buf < metadata_size) {
/* need more data in order to read the complete header */
return 0;
}