diff options
| author | Carl Eugen Hoyos <cehoyos@ag.or.at> | 2013-03-02 18:37:55 +0100 |
|---|---|---|
| committer | Carl Eugen Hoyos <cehoyos@ag.or.at> | 2013-03-02 18:37:55 +0100 |
| commit | 6091a8d92d26f55c83e907da59ffdb8dfc7865c3 (patch) | |
| tree | 8bc14b0c16715cd7b0d77e88c70da571e277aaa9 /libavformat/asfdec.c | |
| parent | 1d5b35cc07c72c3359042a2f13f879cfb2ef549b (diff) | |
| download | ffmpeg-6091a8d92d26f55c83e907da59ffdb8dfc7865c3.tar.gz | |
Avoid huge memory allocations from asf demuxer.
Fixes ticket #1888.
Diffstat (limited to 'libavformat/asfdec.c')
| -rw-r--r-- | libavformat/asfdec.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/libavformat/asfdec.c b/libavformat/asfdec.c index 233b6cae79..38f46a6474 100644 --- a/libavformat/asfdec.c +++ b/libavformat/asfdec.c @@ -1011,6 +1011,7 @@ static int asf_read_frame_header(AVFormatContext *s, AVIOContext *pb) asf->packet_obj_size = avio_rl32(pb); if (asf->packet_obj_size >= (1 << 24) || asf->packet_obj_size <= 0) { av_log(s, AV_LOG_ERROR, "packet_obj_size invalid\n"); + asf->packet_obj_size = 0; return AVERROR_INVALIDDATA; } asf->packet_frag_timestamp = avio_rl32(pb); // timestamp |