diff options
| author | Xi Wang <xi.wang@gmail.com> | 2013-01-22 21:40:05 -0500 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-02-07 01:00:01 +0100 |
| commit | c3744b415a97e8385e866613f5da23f6146f28b6 (patch) | |
| tree | 77deae7a7ccd761cc8b9b3a09572841afdd8b3ef /libavcodec/mpeg12.c | |
| parent | 7df878ac15077ccb1a4763fc285bd7e02b7b6a1f (diff) | |
| download | ffmpeg-c3744b415a97e8385e866613f5da23f6146f28b6.tar.gz | |
rtmp: fix buffer overflows in ff_amf_tag_contents()
A negative `size' will bypass FFMIN(). In the subsequent memcpy() call,
`size' will be considered as a large positive value, leading to a buffer
overflow.
Change the type of `size' to unsigned int to avoid buffer overflow, and
simplify overflow checks accordingly.
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 4e692374f7962ea358c329de38c380103f8991b6)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/mpeg12.c')
0 files changed, 0 insertions, 0 deletions