diff options
| author | Laurent Aimar <fenrir@videolan.org> | 2011-09-24 23:16:17 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2011-10-01 20:24:31 +0200 |
| commit | 21c9d92646f375f0c3ff9b2bc7b2f5f07a150e74 (patch) | |
| tree | b1587f5f3301bd177ef668e7d0c8c0bca81e39b5 /libavcodec | |
| parent | be22dc60f55bb99dcb0a90ad2e8773612a63a288 (diff) | |
| download | ffmpeg-21c9d92646f375f0c3ff9b2bc7b2f5f07a150e74.tar.gz | |
Fix potential overread in vmd audio decoder.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 00cbe9e4053fd562b6f21e76aca6636ff926b637)
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/vmdav.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/libavcodec/vmdav.c b/libavcodec/vmdav.c index b9acfe921c..ebc8c7eb1d 100644 --- a/libavcodec/vmdav.c +++ b/libavcodec/vmdav.c @@ -523,7 +523,10 @@ static int vmdaudio_decode_frame(AVCodecContext *avctx, silent_chunks = 0; if (block_type == BLOCK_TYPE_INITIAL) { - uint32_t flags = AV_RB32(buf); + uint32_t flags; + if (buf_size < 4) + return -1; + flags = AV_RB32(buf); silent_chunks = av_popcount(flags); buf += 4; buf_size -= 4; |