diff options
| author | Reimar Döffinger <Reimar.Doeffinger@gmx.de> | 2013-02-23 19:44:46 +0100 |
|---|---|---|
| committer | Reimar Döffinger <Reimar.Doeffinger@gmx.de> | 2013-02-24 00:01:56 +0100 |
| commit | 50a37f9202a86c3dcdd7076ecf8f0d446c542b25 (patch) | |
| tree | ecea21ce1e610d3d532cc199adf747bcfa8814ad /libavformat/pmpdec.c | |
| parent | 82d79289db03ddc85ea6d5c81a5151e1ad64b2b5 (diff) | |
| download | ffmpeg-50a37f9202a86c3dcdd7076ecf8f0d446c542b25.tar.gz | |
pmpdec: check for EOF while reading index.
Otherwise even a tiny file can trigger a huge memory allocation.
Related to ticket #2298.
Signed-off-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>
Diffstat (limited to 'libavformat/pmpdec.c')
| -rw-r--r-- | libavformat/pmpdec.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/libavformat/pmpdec.c b/libavformat/pmpdec.c index 2ea37ef030..313370787e 100644 --- a/libavformat/pmpdec.c +++ b/libavformat/pmpdec.c @@ -105,6 +105,10 @@ static int pmp_header(AVFormatContext *s) for (i = 0; i < index_cnt; i++) { int size = avio_rl32(pb); int flags = size & 1 ? AVINDEX_KEYFRAME : 0; + if (url_feof(pb)) { + av_log(s, AV_LOG_FATAL, "Encountered EOF while reading index.\n"); + return AVERROR_INVALIDDATA; + } size >>= 1; av_add_index_entry(vst, pos, i, size, 0, flags); pos += size; |