diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2015-05-12 18:03:55 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2015-05-21 20:43:38 +0200 |
| commit | 1973b6ac5cf9424169d2e4774cd2b61c1e19ee77 (patch) | |
| tree | dd0cf60474d358e89ac9f6e2fc2edf9c719e839e /libavformat | |
| parent | 9c10c0fdcd2f77d39fc019c403bec70c5db9feb1 (diff) | |
| download | ffmpeg-1973b6ac5cf9424169d2e4774cd2b61c1e19ee77.tar.gz | |
avformat/rtpdec_xiph: Check upper bound on len in xiph_handle_packet()
Larger packets are not supported and would cause problems later
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit aa5169935e160551fb1c290d1397da2f04325817)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavformat')
| -rw-r--r-- | libavformat/rtpdec_xiph.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavformat/rtpdec_xiph.c b/libavformat/rtpdec_xiph.c index dc34f9e224..da9a1e2c22 100644 --- a/libavformat/rtpdec_xiph.c +++ b/libavformat/rtpdec_xiph.c @@ -112,7 +112,7 @@ static int xiph_handle_packet(AVFormatContext *ctx, PayloadContext *data, return data->split_pkts > 0; } - if (len < 6) { + if (len < 6 || len > INT_MAX/2) { av_log(ctx, AV_LOG_ERROR, "Invalid %d byte packet\n", len); return AVERROR_INVALIDDATA; } |