diff options
| author | Justin Ruggles <justin.ruggles@gmail.com> | 2012-02-04 17:08:34 -0500 |
|---|---|---|
| committer | Justin Ruggles <justin.ruggles@gmail.com> | 2012-02-06 13:22:01 -0500 |
| commit | f1c3d4a68a743c1b274dc764e54e2df276a7c774 (patch) | |
| tree | 60c5501cf0dd6fd81b9a729dddb05f90d922082f /libavformat | |
| parent | ac3f8d317c5d1e78340b57ebd2b5c1317e175bc2 (diff) | |
| download | ffmpeg-f1c3d4a68a743c1b274dc764e54e2df276a7c774.tar.gz | |
ape: skip packets with invalid size
Diffstat (limited to 'libavformat')
| -rw-r--r-- | libavformat/ape.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/libavformat/ape.c b/libavformat/ape.c index 8145db3a76..4d13e4836c 100644 --- a/libavformat/ape.c +++ b/libavformat/ape.c @@ -379,6 +379,14 @@ static int ape_read_packet(AVFormatContext * s, AVPacket * pkt) else nblocks = ape->blocksperframe; + if (ape->frames[ape->currentframe].size <= 0 || + ape->frames[ape->currentframe].size > INT_MAX - extra_size) { + av_log(s, AV_LOG_ERROR, "invalid packet size: %d\n", + ape->frames[ape->currentframe].size); + ape->currentframe++; + return AVERROR(EIO); + } + if (av_new_packet(pkt, ape->frames[ape->currentframe].size + extra_size) < 0) return AVERROR(ENOMEM); |