aboutsummaryrefslogtreecommitdiffstats
path: root/libavformat/avidec.c
diff options
context:
space:
mode:
authorMax Horn <max@quendi.de>2011-04-12 17:44:20 +0200
committerLuca Barbato <lu_zero@gentoo.org>2011-04-14 13:56:09 +0200
commitca402f32e392590a81a1381dab41c4f9c2c2f98a (patch)
tree96fecc535e204b9406e2f888cb1f8ac3ce9b3047 /libavformat/avidec.c
parentad4c50347a46a67807925245e730f738cb4d6562 (diff)
downloadffmpeg-ca402f32e392590a81a1381dab41c4f9c2c2f98a.tar.gz
handle malloc failures in ff_get_wav_header
ff_get_wav_header is reading data from a WAVE file and then uses it (without validation) to malloc a buffer. It then proceeded to read data into the buffer, without verifying that the allocation succeeded. To address this, change ff_get_wav_header to return an error if allocation failed, and adapted all calling code to handle that error. Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Diffstat (limited to 'libavformat/avidec.c')
-rw-r--r--libavformat/avidec.c5
1 files changed, 4 insertions, 1 deletions
diff --git a/libavformat/avidec.c b/libavformat/avidec.c
index ae8d32045f..ec3aa9335a 100644
--- a/libavformat/avidec.c
+++ b/libavformat/avidec.c
@@ -345,6 +345,7 @@ static int avi_read_header(AVFormatContext *s, AVFormatParameters *ap)
int avih_width=0, avih_height=0;
int amv_file_format=0;
uint64_t list_end = 0;
+ int ret;
avi->stream_index= -1;
@@ -623,7 +624,9 @@ static int avi_read_header(AVFormatContext *s, AVFormatParameters *ap)
// avio_skip(pb, size - 5 * 4);
break;
case AVMEDIA_TYPE_AUDIO:
- ff_get_wav_header(pb, st->codec, size);
+ ret = ff_get_wav_header(pb, st->codec, size);
+ if (ret < 0)
+ return ret;
ast->dshow_block_align= st->codec->block_align;
if(ast->sample_size && st->codec->block_align && ast->sample_size != st->codec->block_align){
av_log(s, AV_LOG_WARNING, "sample size (%d) != block align (%d)\n", ast->sample_size, st->codec->block_align);