diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-02-23 22:05:30 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-02-24 00:13:54 +0100 |
| commit | 066739f6bc628188bdbbd2695196acfd16ec79e1 (patch) | |
| tree | 2fe85e72caeec108e53af5612099f945bb2c306a /libavformat/pmpdec.c | |
| parent | 7276e9ea95a5d086e4892d0c698c75b0f8ea8d5e (diff) | |
| download | ffmpeg-066739f6bc628188bdbbd2695196acfd16ec79e1.tar.gz | |
pmpdec: check packet sizes
Reviewed-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavformat/pmpdec.c')
| -rw-r--r-- | libavformat/pmpdec.c | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/libavformat/pmpdec.c b/libavformat/pmpdec.c index 1ee2e2e19a..06b2271f81 100644 --- a/libavformat/pmpdec.c +++ b/libavformat/pmpdec.c @@ -49,6 +49,8 @@ static int pmp_header(AVFormatContext *s) int srate, channels; int i; uint64_t pos; + int64_t fsize = avio_size(pb); + AVStream *vst = avformat_new_stream(s, NULL); if (!vst) return AVERROR(ENOMEM); @@ -100,8 +102,16 @@ static int pmp_header(AVFormatContext *s) return AVERROR_INVALIDDATA; } size >>= 1; + if (size < 9 + 4*pmp->num_streams) { + av_log(s, AV_LOG_ERROR, "Packet too small\n"); + return AVERROR_INVALIDDATA; + } av_add_index_entry(vst, pos, i, size, 0, flags); pos += size; + if (fsize > 0 && i == 0 && pos > fsize) { + av_log(s, AV_LOG_ERROR, "File ends before first packet\n"); + return AVERROR_INVALIDDATA; + } } for (i = 1; i < pmp->num_streams; i++) { AVStream *ast = avformat_new_stream(s, NULL); |