diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2015-05-12 18:03:55 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2015-06-01 23:25:20 +0200 |
| commit | 18e83992f20e31d71b0bf87f2deb4e95e3abc333 (patch) | |
| tree | 25cd6ac4b709ac05a9f104eb302b45d7ca0f926c /libavformat | |
| parent | bec4b3c856e1399de3046ec2a0e0cef642188b6a (diff) | |
| download | ffmpeg-18e83992f20e31d71b0bf87f2deb4e95e3abc333.tar.gz | |
avformat/rtpdec_xiph: Check upper bound on len in xiph_handle_packet()
Larger packets are not supported and would cause problems later
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit aa5169935e160551fb1c290d1397da2f04325817)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavformat')
| -rw-r--r-- | libavformat/rtpdec_xiph.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavformat/rtpdec_xiph.c b/libavformat/rtpdec_xiph.c index dc34f9e224..da9a1e2c22 100644 --- a/libavformat/rtpdec_xiph.c +++ b/libavformat/rtpdec_xiph.c @@ -112,7 +112,7 @@ static int xiph_handle_packet(AVFormatContext *ctx, PayloadContext *data, return data->split_pkts > 0; } - if (len < 6) { + if (len < 6 || len > INT_MAX/2) { av_log(ctx, AV_LOG_ERROR, "Invalid %d byte packet\n", len); return AVERROR_INVALIDDATA; } |