diff options
| author | Anton Khirnov <anton@khirnov.net> | 2012-10-16 10:37:29 +0200 |
|---|---|---|
| committer | Anton Khirnov <anton@khirnov.net> | 2012-10-16 18:52:21 +0200 |
| commit | a43283b6f4cfbf821d12a94270df8a2199599cc9 (patch) | |
| tree | 1f7c1b32b28fb8111f23dac8c04fef941a5fd706 /libavformat/wavdec.c | |
| parent | 79922d7237aba2b8c6abbd2e06a0c08e4f498ad4 (diff) | |
| download | ffmpeg-a43283b6f4cfbf821d12a94270df8a2199599cc9.tar.gz | |
wavdec: check size before reading the data, not after.
Diffstat (limited to 'libavformat/wavdec.c')
| -rw-r--r-- | libavformat/wavdec.c | 5 |
1 files changed, 2 insertions, 3 deletions
diff --git a/libavformat/wavdec.c b/libavformat/wavdec.c index 9e48531fc8..c9f7abbbcf 100644 --- a/libavformat/wavdec.c +++ b/libavformat/wavdec.c @@ -204,7 +204,7 @@ static int wav_read_header(AVFormatContext *s) int64_t size, av_uninit(data_size); int64_t sample_count=0; int rf64; - uint32_t tag, list_type; + uint32_t tag; AVIOContext *pb = s->pb; AVStream *st = NULL; WAVDemuxContext *wav = s->priv_data; @@ -287,12 +287,11 @@ static int wav_read_header(AVFormatContext *s) return ret; break; case MKTAG('L', 'I', 'S', 'T'): - list_type = avio_rl32(pb); if (size < 4) { av_log(s, AV_LOG_ERROR, "too short LIST"); return AVERROR_INVALIDDATA; } - switch (list_type) { + switch (avio_rl32(pb)) { case MKTAG('I', 'N', 'F', 'O'): if ((ret = ff_read_riff_info(s, size - 4)) < 0) return ret; |