diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2016-12-05 11:14:51 +0100 |
|---|---|---|
| committer | Martin Storsjö <martin@martin.st> | 2016-12-15 15:45:59 +0200 |
| commit | a4fec9a7eab842ea5eea1b1ee98624356cb31422 (patch) | |
| tree | 86ebc265fa54d54887e475a0cb1799a1340991b5 /libavcodec/x86/mpegvideoenc_qns_template.c | |
| parent | cdcfa97dc49d83b5eefd0a651db6bb0a6f98e8f2 (diff) | |
| download | ffmpeg-a4fec9a7eab842ea5eea1b1ee98624356cb31422.tar.gz | |
rtmppkt: Check for packet size mismatches
When receiving fragmented packets, the first packet declares the size,
and the later ones normally are small follow-on packets that don't repeat
the size and the other header fields. But technically, the later fragments
also can have a full header, declaring a different size than the previous
packet.
If the follow-on packet declares a larger size than the initial one, we
could end up writing outside of the allocation.
This fixes out of bounds writes.
Found-by: Paul Cher <paulcher@icloud.com>
Reviewed-by: Paul Cher <paulcher@icloud.com>
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
Diffstat (limited to 'libavcodec/x86/mpegvideoenc_qns_template.c')
0 files changed, 0 insertions, 0 deletions