diff options
author | Justin Ruggles <justin.ruggles@gmail.com> | 2012-02-05 02:08:34 +0400 |
---|---|---|
committer | Justin Ruggles <justin.ruggles@gmail.com> | 2012-02-06 22:22:01 +0400 |
commit | f1c3d4a68a743c1b274dc764e54e2df276a7c774 (patch) | |
tree | 60c5501cf0dd6fd81b9a729dddb05f90d922082f /libavformat | |
parent | ac3f8d317c5d1e78340b57ebd2b5c1317e175bc2 (diff) |
ape: skip packets with invalid size
Diffstat (limited to 'libavformat')
-rw-r--r-- | libavformat/ape.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/libavformat/ape.c b/libavformat/ape.c index 8145db3a76..4d13e4836c 100644 --- a/libavformat/ape.c +++ b/libavformat/ape.c @@ -379,6 +379,14 @@ static int ape_read_packet(AVFormatContext * s, AVPacket * pkt) else nblocks = ape->blocksperframe; + if (ape->frames[ape->currentframe].size <= 0 || + ape->frames[ape->currentframe].size > INT_MAX - extra_size) { + av_log(s, AV_LOG_ERROR, "invalid packet size: %d\n", + ape->frames[ape->currentframe].size); + ape->currentframe++; + return AVERROR(EIO); + } + if (av_new_packet(pkt, ape->frames[ape->currentframe].size + extra_size) < 0) return AVERROR(ENOMEM); |