diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-05-05 20:10:45 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-05-05 20:22:09 +0200 |
| commit | 517dcc9b5fc4294669c0b6edaaa3ff166d412219 (patch) | |
| tree | afff025f131c22971259fd339a1663191fbb3a20 /libavformat/electronicarts.c | |
| parent | 5f4e18cd162be2375cdd623816de58207b0b8a31 (diff) | |
| parent | f0ccd53a3b0bbe704a7bc94dbc8caac7be81e079 (diff) | |
| download | ffmpeg-517dcc9b5fc4294669c0b6edaaa3ff166d412219.tar.gz | |
Merge remote-tracking branch 'qatar/master'
* qatar/master:
tests: Refactor rotozoom/videogen common code into a separate file.
tests: Mark some file-internal symbols as static.
build: Drop leftover .exp pattern from LIBSUFFIXES list.
vsrc_buffer: return EAGAIN if no frame is available.
WMAL: Shift output samples by the specified number of padding zeroes.
WMAL: Restore removed code in mclms_predict()
rtpdec_h264: Remove a useless ifdef
rtpdec_h264: Remove outdated/useless/incorrect comments
rtpdec_h264: Remove useless memory corruption checks
rtpdec_h264: Return proper error codes
rtpdec_h264: Check the available data length before reading
rtpdec_h264: Add input size checks
png: check bit depth for PAL8/Y400A pixel formats.
ea: check chunk_size for validity.
celp filters: Do not read earlier than the start of the 'out' vector.
Conflicts:
libavcodec/pngdec.c
libavfilter/src_buffer.c
tests/rotozoom.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavformat/electronicarts.c')
| -rw-r--r-- | libavformat/electronicarts.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/libavformat/electronicarts.c b/libavformat/electronicarts.c index 0fb66970d6..3070b05780 100644 --- a/libavformat/electronicarts.c +++ b/libavformat/electronicarts.c @@ -495,12 +495,17 @@ static int ea_read_packet(AVFormatContext *s, while (!packet_read || partial_packet) { chunk_type = avio_rl32(pb); - chunk_size = (ea->big_endian ? avio_rb32(pb) : avio_rl32(pb)) - 8; + chunk_size = ea->big_endian ? avio_rb32(pb) : avio_rl32(pb); + if (chunk_size <= 8) + return AVERROR_INVALIDDATA; + chunk_size -= 8; switch (chunk_type) { /* audio data */ case ISNh_TAG: /* header chunk also contains data; skip over the header portion*/ + if (chunk_size < 32) + return AVERROR_INVALIDDATA; avio_skip(pb, 32); chunk_size -= 32; case ISNd_TAG: |