RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

pmpdec: check packet sizes 

Reviewed-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2013-02-23 22:05:30 +01:00
parent 7276e9ea95
commit 066739f6bc
1 changed files with 10 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
libavformat/pmpdec.c
View File

@ -49,6 +49,8 @@ static int pmp_header(AVFormatContext *s)
int srate, channels; int srate, channels;
int i; int i;
uint64_t pos; uint64_t pos;
int64_t fsize = avio_size(pb);
AVStream *vst = avformat_new_stream(s, NULL); AVStream *vst = avformat_new_stream(s, NULL);
if (!vst) if (!vst)
return AVERROR(ENOMEM); return AVERROR(ENOMEM);
@ -100,8 +102,16 @@ static int pmp_header(AVFormatContext *s)
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
} }
size >>= 1; size >>= 1;
if (size < 9 + 4*pmp->num_streams) {
av_log(s, AV_LOG_ERROR, "Packet too small\n");
return AVERROR_INVALIDDATA;
}
av_add_index_entry(vst, pos, i, size, 0, flags); av_add_index_entry(vst, pos, i, size, 0, flags);
pos += size; pos += size;
if (fsize > 0 && i == 0 && pos > fsize) {
av_log(s, AV_LOG_ERROR, "File ends before first packet\n");
return AVERROR_INVALIDDATA;
}
} }
for (i = 1; i < pmp->num_streams; i++) { for (i = 1; i < pmp->num_streams; i++) {
AVStream *ast = avformat_new_stream(s, NULL); AVStream *ast = avformat_new_stream(s, NULL);