diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2011-12-20 18:00:30 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2011-12-20 18:07:14 +0100 |
| commit | c1acd58198187b9d0ca9386add4c10fca33d2c21 (patch) | |
| tree | 5be487bd80f169524d6b51e73ce3c34444b1e2c1 /libavformat | |
| parent | a8469223f6bb756a44f6579439fcae24ccc739b1 (diff) | |
| download | ffmpeg-c1acd58198187b9d0ca9386add4c10fca33d2c21.tar.gz | |
roq: fix excessive memory alloc
Fixes Ticket802
Bug found by: Oana Stratulat
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavformat')
| -rw-r--r-- | libavformat/idroqdec.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/libavformat/idroqdec.c b/libavformat/idroqdec.c index eb11c69adb..9ac32eb668 100644 --- a/libavformat/idroqdec.c +++ b/libavformat/idroqdec.c @@ -30,6 +30,7 @@ #include "libavutil/intreadwrite.h" #include "avformat.h" #include "internal.h" +#include "avio_internal.h" #define RoQ_MAGIC_NUMBER 0x1084 #define RoQ_CHUNK_PREAMBLE_SIZE 8 @@ -125,6 +126,8 @@ static int roq_read_packet(AVFormatContext *s, if(chunk_size > INT_MAX) return AVERROR_INVALIDDATA; + chunk_size = ffio_limit(pb, chunk_size); + switch (chunk_type) { case RoQ_INFO: |