aboutsummaryrefslogtreecommitdiffstats
path: root/libavformat
diff options
context:
space:
mode:
authorAndreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>2016-01-06 07:32:25 +0100
committerAnton Khirnov <anton@khirnov.net>2016-01-07 08:20:21 +0100
commit2aec600ae7af7d46a4877b5ccc263b39f05a91cb (patch)
treeb123102db75c64b77b3b91841a4fdf2a9dd2c9a9 /libavformat
parentc69461d73797e02e7a3ab4316050c241fa91f53f (diff)
downloadffmpeg-2aec600ae7af7d46a4877b5ccc263b39f05a91cb.tar.gz
asfdec: reject size > INT64_MAX in asf_read_unknown
Both avio_skip and detect_unknown_subobject use int64_t for the size parameter. This fixes a segmentation fault due to infinite recursion. Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com> Signed-off-by: Alexandra Hájková <alexandra.khirnova@gmail.com> Signed-off-by: Anton Khirnov <anton@khirnov.net>
Diffstat (limited to 'libavformat')
-rw-r--r--libavformat/asfdec.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/libavformat/asfdec.c b/libavformat/asfdec.c
index 58480dc36a..4fc0e3dbb0 100644
--- a/libavformat/asfdec.c
+++ b/libavformat/asfdec.c
@@ -178,6 +178,9 @@ static int asf_read_unknown(AVFormatContext *s, const GUIDParseTable *g)
uint64_t size = avio_rl64(pb);
int ret;
+ if (size > INT64_MAX)
+ return AVERROR_INVALIDDATA;
+
if (asf->is_header)
asf->unknown_size = size;
asf->is_header = 0;