diff options
| author | Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com> | 2016-01-05 15:01:53 +0300 |
|---|---|---|
| committer | Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com> | 2016-01-06 00:30:50 +0300 |
| commit | da3c3c446cb434be9d0025f519e00c2385135c85 (patch) | |
| tree | f4e19a0499e85a2ac1046df39b521cd6ef2160f6 /libavcodec/avpacket.c | |
| parent | fa74cdc60d19798c951dcc242ca7273e6483f2b3 (diff) | |
avpacket: fix size check in packet_alloc
The previous check only caught sizes from -AV_INPUT_BUFFER_PADDING_SIZE
to -1.
This fixes ubsan runtime error: signed integer overflow: 2147483647 + 32
cannot be represented in type 'int'
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Diffstat (limited to 'libavcodec/avpacket.c')
| -rw-r--r-- | libavcodec/avpacket.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavcodec/avpacket.c b/libavcodec/avpacket.c index 97c12b57fb..4901d361b1 100644 --- a/libavcodec/avpacket.c +++ b/libavcodec/avpacket.c @@ -71,7 +71,7 @@ void av_packet_free(AVPacket **pkt) static int packet_alloc(AVBufferRef **buf, int size) { int ret; - if ((unsigned)size >= (unsigned)size + AV_INPUT_BUFFER_PADDING_SIZE) + if (size < 0 || size >= INT_MAX - AV_INPUT_BUFFER_PADDING_SIZE) return AVERROR(EINVAL); ret = av_buffer_realloc(buf, size + AV_INPUT_BUFFER_PADDING_SIZE); |