diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2016-01-15 01:20:58 +0300 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2016-01-15 01:49:52 +0300 |
| commit | 80fd348bb7d9ee55c3100da87795f3a5bcbdfb32 (patch) | |
| tree | 5b6c019fde6dcbe22276d7b9767806c8a22b6d94 /libavformat | |
| parent | fc2588a1d6cbb17f15e05f585c92a3be734bcc5a (diff) | |
avformat/rmdec: Check size in ivr_read_packet() before use
Fixes out of array access
Fixes: asan_heap-oob_445b39_1741_d00eb645ab48eb2203b4a04a5b997103.ivr
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavformat')
| -rw-r--r-- | libavformat/rmdec.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/libavformat/rmdec.c b/libavformat/rmdec.c index 4e46a3d6e6..ad919e87d1 100644 --- a/libavformat/rmdec.c +++ b/libavformat/rmdec.c @@ -1357,6 +1357,11 @@ static int ivr_read_packet(AVFormatContext *s, AVPacket *pkt) size = avio_rb32(pb); avio_skip(pb, 4); + if (size < 1 || size > INT_MAX/4) { + av_log(s, AV_LOG_ERROR, "size %d is invalid\n"); + return AVERROR_INVALIDDATA; + } + st = s->streams[index]; ret = ff_rm_parse_packet(s, pb, st, st->priv_data, size, pkt, &seq, 0, pts); |