diff options
| author | Alex Converse <alex.converse@gmail.com> | 2012-01-12 11:12:24 -0800 |
|---|---|---|
| committer | Alex Converse <alex.converse@gmail.com> | 2012-01-12 13:26:13 -0800 |
| commit | 4df30f71147b7bedd4457bcfa0e4efe01085af9f (patch) | |
| tree | a6fec3f3b2deab2e07269d0b6ca21bd8e11be485 /libavformat | |
| parent | 81dc6a2a3cefc1f1bbbc249052b3374e524d1ea0 (diff) | |
| download | ffmpeg-4df30f71147b7bedd4457bcfa0e4efe01085af9f.tar.gz | |
utils: Check for extradata size overflows.
Diffstat (limited to 'libavformat')
| -rw-r--r-- | libavformat/utils.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/libavformat/utils.c b/libavformat/utils.c index a79665801f..373f06831d 100644 --- a/libavformat/utils.c +++ b/libavformat/utils.c @@ -2442,9 +2442,11 @@ int avformat_find_stream_info(AVFormatContext *ic, AVDictionary **options) } if(st->parser && st->parser->parser->split && !st->codec->extradata){ int i= st->parser->parser->split(st->codec, pkt->data, pkt->size); - if(i){ + if (i > 0 && i < FF_MAX_EXTRADATA_SIZE) { st->codec->extradata_size= i; st->codec->extradata= av_malloc(st->codec->extradata_size + FF_INPUT_BUFFER_PADDING_SIZE); + if (!st->codec->extradata) + return AVERROR(ENOMEM); memcpy(st->codec->extradata, pkt->data, st->codec->extradata_size); memset(st->codec->extradata + i, 0, FF_INPUT_BUFFER_PADDING_SIZE); } |