diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2024-06-07 00:19:01 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2024-07-02 21:57:23 +0200 |
| commit | ca237a841e9e78ac02694124d81ff78c74b0bf72 (patch) | |
| tree | c099561db1dd6af239c29948305dd6e0509de7c8 /libavformat/mpeg.c | |
| parent | 64df7d4c1ee30b4be500f6aac2fc81b78b987af6 (diff) | |
| download | ffmpeg-ca237a841e9e78ac02694124d81ff78c74b0bf72.tar.gz | |
avformat/mpeg: Check len in mpegps_probe()
Fixes: CID1473590 Untrusted loop bound
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavformat/mpeg.c')
| -rw-r--r-- | libavformat/mpeg.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/libavformat/mpeg.c b/libavformat/mpeg.c index 5556861e1c..c3dff3e4ea 100644 --- a/libavformat/mpeg.c +++ b/libavformat/mpeg.c @@ -76,6 +76,9 @@ static int mpegps_probe(const AVProbeData *p) int pes = endpes <= i && check_pes(p->buf + i, p->buf + p->buf_size); int pack = check_pack_header(p->buf + i); + if (len > INT_MAX - i) + break; + if (code == SYSTEM_HEADER_START_CODE) sys++; else if (code == PACK_START_CODE && pack) |