diff options
| author | Carl Eugen Hoyos <cehoyos@ag.or.at> | 2014-01-20 11:40:35 +0100 |
|---|---|---|
| committer | Carl Eugen Hoyos <cehoyos@ag.or.at> | 2014-01-20 11:40:35 +0100 |
| commit | b7702fafb356b757dcd1b3d1ed4f2f32e4ebe9c1 (patch) | |
| tree | 8f9710ffeea070fe2423ef03d5cc5670c5627525 /libavformat/avidec.c | |
| parent | 9b78abae19aa18e8427848f4d4367da3822ed627 (diff) | |
| download | ffmpeg-b7702fafb356b757dcd1b3d1ed4f2f32e4ebe9c1.tar.gz | |
Avoid a possible overflow when reading Nikon avi files.
Suggested-by: Reimar
Diffstat (limited to 'libavformat/avidec.c')
| -rw-r--r-- | libavformat/avidec.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/libavformat/avidec.c b/libavformat/avidec.c index 57fbcd7a1b..bab62a08c1 100644 --- a/libavformat/avidec.c +++ b/libavformat/avidec.c @@ -350,8 +350,7 @@ static void avi_read_nikon(AVFormatContext *s, uint64_t end) uint16_t size = avio_rl16(s->pb); const char *name = NULL; char buffer[64] = { 0 }; - if (avio_tell(s->pb) + size > tag_end) - size = tag_end - avio_tell(s->pb); + size = FFMIN(size, tag_end - avio_tell(s->pb)); size -= avio_read(s->pb, buffer, FFMIN(size, sizeof(buffer) - 1)); switch (tag) { |