diff options
| author | Reimar Döffinger <Reimar.Doeffinger@gmx.de> | 2012-04-10 21:11:50 +0200 |
|---|---|---|
| committer | Reimar Döffinger <Reimar.Doeffinger@gmx.de> | 2012-04-11 22:28:34 +0200 |
| commit | 8e357e8e759b36e5609ccd12a9e324aee0e8afc8 (patch) | |
| tree | ee6ea4bdd6e51d2740511bbcfd6f109b620e6c21 /libavformat | |
| parent | a736eb4a605f46d5ff96c7b32e55710ecd9cce89 (diff) | |
| download | ffmpeg-8e357e8e759b36e5609ccd12a9e324aee0e8afc8.tar.gz | |
latmenc: error out when packet size is too large.
Previously it would just silently write out incorrect data.
This also fixes a potential integer overflow in the allocation.
Signed-off-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>
Diffstat (limited to 'libavformat')
| -rw-r--r-- | libavformat/latmenc.c | 12 |
1 files changed, 11 insertions, 1 deletions
diff --git a/libavformat/latmenc.c b/libavformat/latmenc.c index 3eadfe0092..3ee277d701 100644 --- a/libavformat/latmenc.c +++ b/libavformat/latmenc.c @@ -138,7 +138,7 @@ static int latm_write_packet(AVFormatContext *s, AVPacket *pkt) PutBitContext bs; int i, len; uint8_t loas_header[] = "\x56\xe0\x00"; - uint8_t *buf; + uint8_t *buf = NULL; if (s->streams[0]->codec->codec_id == CODEC_ID_AAC_LATM) return ff_raw_write_packet(s, pkt); @@ -147,6 +147,8 @@ static int latm_write_packet(AVFormatContext *s, AVPacket *pkt) av_log(s, AV_LOG_ERROR, "ADTS header detected - ADTS will not be incorrectly muxed into LATM\n"); return AVERROR_INVALIDDATA; } + if (pkt->size > 0x1fff) + goto too_large; buf = av_malloc(pkt->size+1024); if (!buf) @@ -173,6 +175,9 @@ static int latm_write_packet(AVFormatContext *s, AVPacket *pkt) len = put_bits_count(&bs) >> 3; + if (len > 0x1fff) + goto too_large; + loas_header[1] |= (len >> 8) & 0x1f; loas_header[2] |= len & 0xff; @@ -182,6 +187,11 @@ static int latm_write_packet(AVFormatContext *s, AVPacket *pkt) av_free(buf); return 0; + +too_large: + av_log(s, AV_LOG_ERROR, "LATM packet size larger than maximum size 0x1fff\n"); + av_free(buf); + return AVERROR_INVALIDDATA; } AVOutputFormat ff_latm_muxer = { |