diff options
| author | Alex Converse <alex.converse@gmail.com> | 2011-07-29 15:27:36 -0700 |
|---|---|---|
| committer | Alex Converse <alex.converse@gmail.com> | 2011-07-29 16:03:53 -0700 |
| commit | 1f6f58d5855288492fc2640a9f1035c01c75d356 (patch) | |
| tree | 8b080c7dfeae7077be2b008607005af5d07f00f5 /libavformat/mxfdec.c | |
| parent | a3bf7b864acae5921f5de53b45945770e93e6237 (diff) | |
| download | ffmpeg-1f6f58d5855288492fc2640a9f1035c01c75d356.tar.gz | |
mxfdec: Include FF_INPUT_BUFFER_PADDING_SIZE when allocating extradata.
This prevents out of bounds reads when extradata is being decoded.
Diffstat (limited to 'libavformat/mxfdec.c')
| -rw-r--r-- | libavformat/mxfdec.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c index e2688b1bff..8906bdd78f 100644 --- a/libavformat/mxfdec.c +++ b/libavformat/mxfdec.c @@ -600,7 +600,7 @@ static int mxf_read_generic_descriptor(void *arg, AVIOContext *pb, int tag, int default: /* Private uid used by SONY C0023S01.mxf */ if (IS_KLV_KEY(uid, mxf_sony_mpeg4_extradata)) { - descriptor->extradata = av_malloc(size); + descriptor->extradata = av_malloc(size + FF_INPUT_BUFFER_PADDING_SIZE); if (!descriptor->extradata) return -1; descriptor->extradata_size = size; |