diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2005-01-08 14:21:33 +0000 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2005-01-08 14:21:33 +0000 |
| commit | 568e18b15e2ddf494fd8926707d34ca08c8edce5 (patch) | |
| tree | 18f59992848e24c529a01bd98aed66af3762b2d1 /libavformat/matroska.c | |
| parent | 934b0821dbb8fb33b2736fe4aab09fc2b6cc8ccc (diff) | |
| download | ffmpeg-568e18b15e2ddf494fd8926707d34ca08c8edce5.tar.gz | |
integer overflows, heap corruption
possible arbitrary code execution cannot be ruled out in some cases
precautionary checks
Originally committed as revision 3813 to svn://svn.ffmpeg.org/ffmpeg/trunk
Diffstat (limited to 'libavformat/matroska.c')
| -rw-r--r-- | libavformat/matroska.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavformat/matroska.c b/libavformat/matroska.c index 9d80302f2c..1e146d464a 100644 --- a/libavformat/matroska.c +++ b/libavformat/matroska.c @@ -669,7 +669,7 @@ ebml_read_ascii (MatroskaDemuxContext *matroska, /* ebml strings are usually not 0-terminated, so we allocate one * byte more, read the string and NULL-terminate it ourselves. */ - if (!(*str = av_malloc(size + 1))) { + if (size < 0 || !(*str = av_malloc(size + 1))) { av_log(matroska->ctx, AV_LOG_ERROR, "Memory allocation failed\n"); return AVERROR_NOMEM; } |