diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2006-05-13 10:45:26 +0000 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2006-05-13 10:45:26 +0000 |
| commit | 3a1a7e32ace7af47de74e8ae779cb4e04c89aa97 (patch) | |
| tree | 54f9925f5f74bf9ca24ede510f6deffd98f2e2c6 /libavcodec/smacker.c | |
| parent | ce1d2a95c3d73663aecc6e5f51533d2bcf1fb1ae (diff) | |
| download | ffmpeg-3a1a7e32ace7af47de74e8ae779cb4e04c89aa97.tar.gz | |
sanity checks, some might have been exploitable ...
Originally committed as revision 5369 to svn://svn.ffmpeg.org/ffmpeg/trunk
Diffstat (limited to 'libavcodec/smacker.c')
| -rw-r--r-- | libavcodec/smacker.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/libavcodec/smacker.c b/libavcodec/smacker.c index 7a142de1b1..a6f169aca6 100644 --- a/libavcodec/smacker.c +++ b/libavcodec/smacker.c @@ -177,6 +177,11 @@ static int smacker_decode_header_tree(SmackVContext *smk, GetBitContext *gb, int int escapes[3]; DBCtx ctx; + if(size >= UINT_MAX>>4){ // (((size + 3) >> 2) + 3) << 2 must not overflow + av_log(smk->avctx, AV_LOG_ERROR, "size too large\n"); + return -1; + } + tmp1.length = 256; tmp1.maxlength = 0; tmp1.current = 0; |