diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2011-09-09 00:37:31 +0400 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2011-09-09 00:37:31 +0400 |
| commit | 78d7d8fe9170f38ee0b2ab6f731ff1a61c712db5 (patch) | |
| tree | 3fa4f47e3f1cca5a0cf39b42a5d171dec9a5b53f /libavformat/rtpdec_asf.c | |
| parent | 04c13dca8812e8302686887b6e8201d4ad25b7d8 (diff) | |
| parent | 6376362d15ccbc02e15d0b3b7a7a5d862efd6b91 (diff) | |
Merge remote-tracking branch 'qatar/master'
* qatar/master:
Employ FF_ARRAY_ELEMS instead of manually calculating array length.
Fixed invalid access in wavpack decoder on corrupted bitstream.
Fixed invalid writes in wavpack decoder on corrupted bitstreams.
Fixed invalid access in wavpack decoder on corrupted extra bits sub-blocks.
rtpdec_asf: Fix integer underflow that could allow remote code execution
Conflicts:
libavformat/rtpdec_asf.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavformat/rtpdec_asf.c')
| -rw-r--r-- | libavformat/rtpdec_asf.c | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/libavformat/rtpdec_asf.c b/libavformat/rtpdec_asf.c index 643ea7a5a0..b481c37c82 100644 --- a/libavformat/rtpdec_asf.c +++ b/libavformat/rtpdec_asf.c @@ -233,14 +233,14 @@ static int asfrtp_parse_packet(AVFormatContext *s, PayloadContext *asf, int cur_len = start_off + len_off - off; int prev_len = out_len; - void *newbuf; + void *newmem; out_len += cur_len; - if(FFMIN(cur_len, len - off)<0) + if (FFMIN(cur_len, len - off) < 0) return -1; - newbuf = av_realloc(asf->buf, out_len); - if(!newbuf) + newmem = av_realloc(asf->buf, out_len); + if (!newmem) return -1; - asf->buf= newbuf; + asf->buf = newmem; memcpy(asf->buf + prev_len, buf + off, FFMIN(cur_len, len - off)); avio_skip(pb, cur_len); |