diff options
| -rw-r--r-- | libavformat/wtvdec.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/libavformat/wtvdec.c b/libavformat/wtvdec.c index 551242d8a1..ab51171349 100644 --- a/libavformat/wtvdec.c +++ b/libavformat/wtvdec.c @@ -261,7 +261,12 @@ static AVIOContext * wtvfile_open2(AVFormatContext *s, const uint8_t *buf, int b dir_length = AV_RL16(buf + 16); file_length = AV_RL64(buf + 24); name_size = 2 * AV_RL32(buf + 32); - if (buf + 48 + (int64_t)name_size > buf_end || name_size<0) { + if (name_size < 0) { + av_log(s, AV_LOG_ERROR, + "bad filename length, remaining directory entries ignored\n"); + break; + } + if (48 + (int64_t)name_size > buf_end - buf) { av_log(s, AV_LOG_ERROR, "filename exceeds buffer size; remaining directory entries ignored\n"); break; } |