diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2014-10-25 05:44:17 +0400 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2014-10-25 06:03:41 +0400 |
| commit | af89c144181f4a7003477c22a88d40b366b42a7c (patch) | |
| tree | a927915b8490449414eb240d8277faff10d3e400 /libavformat/flac_picture.c | |
| parent | d6095662706d3f0b334645eb7f92ed24a4d9e4ed (diff) | |
| parent | 0b66fb4505e0bb43de3797f63f3290f0188d67cc (diff) | |
Merge commit '0b66fb4505e0bb43de3797f63f3290f0188d67cc'
* commit '0b66fb4505e0bb43de3797f63f3290f0188d67cc':
flac_picture: prevent a possible out of bound write
This is only partly merged, the condition this checks for
is impossible to be true as it would imply avio_read() to
read more than the size passed to it
See: 731f7eaaade4c0cf91f8008cc30c0342caa64df1
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavformat/flac_picture.c')
| -rw-r--r-- | libavformat/flac_picture.c | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/libavformat/flac_picture.c b/libavformat/flac_picture.c index 5f2026d1d0..669fd2e782 100644 --- a/libavformat/flac_picture.c +++ b/libavformat/flac_picture.c @@ -33,8 +33,9 @@ int ff_flac_parse_picture(AVFormatContext *s, uint8_t *buf, int buf_size) uint8_t mimetype[64], *desc = NULL; AVIOContext *pb = NULL; AVStream *st; - int type, width, height; - int len, ret = 0; + int width, height, ret = 0; + int len; + unsigned int type; pb = avio_alloc_context(buf, buf_size, 0, NULL, NULL, NULL, NULL); if (!pb) @@ -42,7 +43,7 @@ int ff_flac_parse_picture(AVFormatContext *s, uint8_t *buf, int buf_size) /* read the picture type */ type = avio_rb32(pb); - if (type >= FF_ARRAY_ELEMS(ff_id3v2_picture_types) || type < 0) { + if (type >= FF_ARRAY_ELEMS(ff_id3v2_picture_types)) { av_log(s, AV_LOG_ERROR, "Invalid picture type: %d.\n", type); if (s->error_recognition & AV_EF_EXPLODE) { RETURN_ERROR(AVERROR_INVALIDDATA); @@ -52,7 +53,7 @@ int ff_flac_parse_picture(AVFormatContext *s, uint8_t *buf, int buf_size) /* picture mimetype */ len = avio_rb32(pb); - if (len <= 0 || + if (len <= 0 || len >= 64 || avio_read(pb, mimetype, FFMIN(len, sizeof(mimetype) - 1)) != len) { av_log(s, AV_LOG_ERROR, "Could not read mimetype from an attached " "picture.\n"); |