aboutsummaryrefslogtreecommitdiffstats
path: root/libavformat/flacenc.c
diff options
context:
space:
mode:
authorMichael Niedermayer <michaelni@gmx.at>2015-05-11 15:30:32 +0200
committerMichael Niedermayer <michaelni@gmx.at>2015-05-11 15:31:55 +0200
commit40a7700b82aec0036622f8673ce64e070a520891 (patch)
treeea60a364d1fe68741b45d8117993424f05d815b8 /libavformat/flacenc.c
parenteca38864a6ce5053e463b8d3fc22b22bc9a49578 (diff)
downloadffmpeg-40a7700b82aec0036622f8673ce64e070a520891.tar.gz
avformat/flacenc: Check length in flac_write_block_comment()
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavformat/flacenc.c')
-rw-r--r--libavformat/flacenc.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/libavformat/flacenc.c b/libavformat/flacenc.c
index 4255363f95..a45f83ec21 100644
--- a/libavformat/flacenc.c
+++ b/libavformat/flacenc.c
@@ -50,12 +50,14 @@ static int flac_write_block_comment(AVIOContext *pb, AVDictionary **m,
int last_block, int bitexact)
{
const char *vendor = bitexact ? "ffmpeg" : LIBAVFORMAT_IDENT;
- unsigned int len;
+ int64_t len;
uint8_t *p, *p0;
ff_metadata_conv(m, ff_vorbiscomment_metadata_conv, NULL);
len = ff_vorbiscomment_length(*m, vendor);
+ if (len >= ((1<<24) - 4))
+ return AVERROR(EINVAL);
p0 = av_malloc(len+4);
if (!p0)
return AVERROR(ENOMEM);