diff options
| author | Max Horn <max@quendi.de> | 2011-04-12 17:44:20 +0200 |
|---|---|---|
| committer | Luca Barbato <lu_zero@gentoo.org> | 2011-04-14 13:56:09 +0200 |
| commit | ca402f32e392590a81a1381dab41c4f9c2c2f98a (patch) | |
| tree | 96fecc535e204b9406e2f888cb1f8ac3ce9b3047 /libavformat/matroskadec.c | |
| parent | ad4c50347a46a67807925245e730f738cb4d6562 (diff) | |
| download | ffmpeg-ca402f32e392590a81a1381dab41c4f9c2c2f98a.tar.gz | |
handle malloc failures in ff_get_wav_header
ff_get_wav_header is reading data from a WAVE file and then uses it
(without validation) to malloc a buffer. It then proceeded to read
data into the buffer, without verifying that the allocation succeeded.
To address this, change ff_get_wav_header to return an error if
allocation failed, and adapted all calling code to handle that error.
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Diffstat (limited to 'libavformat/matroskadec.c')
| -rw-r--r-- | libavformat/matroskadec.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c index d1567e7cbe..19c7ca6384 100644 --- a/libavformat/matroskadec.c +++ b/libavformat/matroskadec.c @@ -1329,9 +1329,12 @@ static int matroska_read_header(AVFormatContext *s, AVFormatParameters *ap) } else if (!strcmp(track->codec_id, "A_MS/ACM") && track->codec_priv.size >= 14 && track->codec_priv.data != NULL) { + int ret; ffio_init_context(&b, track->codec_priv.data, track->codec_priv.size, AVIO_RDONLY, NULL, NULL, NULL, NULL); - ff_get_wav_header(&b, st->codec, track->codec_priv.size); + ret = ff_get_wav_header(&b, st->codec, track->codec_priv.size); + if (ret < 0) + return ret; codec_id = st->codec->codec_id; extradata_offset = FFMIN(track->codec_priv.size, 18); } else if (!strcmp(track->codec_id, "V_QUICKTIME") |