diff options
| author | Ronald S. Bultje <rsbultje@gmail.com> | 2010-08-13 20:06:18 +0000 |
|---|---|---|
| committer | Ronald S. Bultje <rsbultje@gmail.com> | 2010-08-13 20:06:18 +0000 |
| commit | afbc4d2dac0434f645bbce80d5a47e11e4d6d5fb (patch) | |
| tree | cd3ac236e2212b7aabd8b6fc2b23eb043d2ab0b6 /libavformat | |
| parent | 67197656d19fa9e084e47b5331c262a9c7842335 (diff) | |
| download | ffmpeg-afbc4d2dac0434f645bbce80d5a47e11e4d6d5fb.tar.gz | |
Prevent overflow on random input.
Originally committed as revision 24795 to svn://svn.ffmpeg.org/ffmpeg/trunk
Diffstat (limited to 'libavformat')
| -rw-r--r-- | libavformat/rtpdec_asf.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/libavformat/rtpdec_asf.c b/libavformat/rtpdec_asf.c index 56df314850..db872ce398 100644 --- a/libavformat/rtpdec_asf.c +++ b/libavformat/rtpdec_asf.c @@ -230,7 +230,8 @@ static int asfrtp_parse_packet(AVFormatContext *s, PayloadContext *asf, int prev_len = out_len; out_len += cur_len; asf->buf = av_realloc(asf->buf, out_len); - memcpy(asf->buf + prev_len, buf + off, cur_len); + memcpy(asf->buf + prev_len, buf + off, + FFMIN(cur_len, len - off)); url_fskip(pb, cur_len); } } |