diff options
author | Xi Wang <xi.wang@gmail.com> | 2013-01-22 21:40:05 -0500 |
---|---|---|
committer | Martin Storsjö <martin@martin.st> | 2013-01-23 13:51:28 +0200 |
commit | ecb918e5f0a4395468862b5fbd11a51de9be3d4f (patch) | |
tree | 42128fdf9170a379234e023ec6a7822636c0c7bb /libavformat/a64.c | |
parent | 3cff53369acdb3bc0695dd6d5df51457fdaa16ce (diff) | |
download | ffmpeg-ecb918e5f0a4395468862b5fbd11a51de9be3d4f.tar.gz |
rtmp: fix buffer overflows in ff_amf_tag_contents()
A negative `size' will bypass FFMIN(). In the subsequent memcpy() call,
`size' will be considered as a large positive value, leading to a buffer
overflow.
Change the type of `size' to unsigned int to avoid buffer overflow, and
simplify overflow checks accordingly. Also change a literal buffer
size to use sizeof, and limit the amount of data copied in another
memcpy call as well.
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Martin Storsjö <martin@martin.st>
Diffstat (limited to 'libavformat/a64.c')
0 files changed, 0 insertions, 0 deletions