diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2011-12-25 12:31:23 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2011-12-25 18:55:43 +0100 |
| commit | 5e9a56a0350c518cd4b38845aff49d41a9c952ae (patch) | |
| tree | d08616fbded79b2c1935c34827d325073e9cec2e /libavcodec | |
| parent | 18bcfc912e48bf77a5202a0e24a3b884b9b2ff2c (diff) | |
| download | ffmpeg-5e9a56a0350c518cd4b38845aff49d41a9c952ae.tar.gz | |
shorten: validate values in fmt chunk search
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/shorten.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/libavcodec/shorten.c b/libavcodec/shorten.c index 1906c69de1..ef58aaa6aa 100644 --- a/libavcodec/shorten.c +++ b/libavcodec/shorten.c @@ -205,7 +205,7 @@ static int decode_wave_header(AVCodecContext *avctx, const uint8_t *header, { int len; short wave_format; - + const uint8_t *end= header + header_size; if (bytestream_get_le32(&header) != MKTAG('R','I','F','F')) { av_log(avctx, AV_LOG_ERROR, "missing RIFF tag\n"); @@ -221,6 +221,8 @@ static int decode_wave_header(AVCodecContext *avctx, const uint8_t *header, while (bytestream_get_le32(&header) != MKTAG('f','m','t',' ')) { len = bytestream_get_le32(&header); + if(len<0 || end - header - 8 < len) + return AVERROR_INVALIDDATA; header += len; } len = bytestream_get_le32(&header); |