diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-06-04 12:29:16 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-06-04 12:29:25 +0200 |
| commit | acc665f22c5c2cb8a507c6ca49756995a4742038 (patch) | |
| tree | 436f81743d3a5dbc3d8be31743e27bb49e2a3d51 /libavformat | |
| parent | a55db1fc497dfa30e9f0596f8bb203f7645d17b7 (diff) | |
| parent | 4c223fe519174f0d7086f4698e9f7b9840cf15e9 (diff) | |
| download | ffmpeg-acc665f22c5c2cb8a507c6ca49756995a4742038.tar.gz | |
Merge remote-tracking branch 'qatar/release/0.5' into release/0.5
* qatar/release/0.5:
Bump version number for 0.5.9 release.
png: check bit depth for PAL8/Y400A pixel formats.
tqi: Pass errors from the MB decoder
eatqi: move "block" variable into context to ensure sufficient alignment for idct_put for compilers/architectures that can not align stack variables that much. This is also consistent with similar code in eatgq.c
ea: check chunk_size for validity.
vfwcap: Include windows.h before vfw.h since the latter requires defines from the former. Patch by kemuri <kemuri9 at gmail dot com>
mingw32: merge checks for mingw-w64 and mingw32-runtime >= 3.15 into one
mingw32: properly check if vfw capture is supported by the system headers
Replace every usage of -lvfw32 with what is particularly necessary for that case: Avisynth -> -lavifil32 VFW Cap -> -lavicap32 Patch by kemuri <kemuri9 at gmail dot com>
configure: properly check for mingw-w64 through installed headers. mingw-w64 can also target 32-bit code.
qdm2: clip array indices returned by qdm2_get_vlc().
kmvc: Check palsize.
adpcm: ADPCM Electronic Arts has always two channels
h264: Add check for invalid chroma_format_idc
dpcm: ignore extra unpaired bytes in stereo streams.
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavformat')
| -rw-r--r-- | libavformat/electronicarts.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/libavformat/electronicarts.c b/libavformat/electronicarts.c index fe19e70f73..ad63c5619b 100644 --- a/libavformat/electronicarts.c +++ b/libavformat/electronicarts.c @@ -448,12 +448,17 @@ static int ea_read_packet(AVFormatContext *s, while (!packet_read) { chunk_type = get_le32(pb); - chunk_size = (ea->big_endian ? get_be32(pb) : get_le32(pb)) - 8; + chunk_size = ea->big_endian ? get_be32(pb) : get_le32(pb); + if (chunk_size <= 8) + return AVERROR_INVALIDDATA; + chunk_size -= 8; switch (chunk_type) { /* audio data */ case ISNh_TAG: /* header chunk also contains data; skip over the header portion*/ + if (chunk_size < 32) + return AVERROR_INVALIDDATA; url_fskip(pb, 32); chunk_size -= 32; case ISNd_TAG: |