RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

asf: prevent packet_size_left from going negative if hdrlen > pktlen. 

This prevents failed assertions further down in the packet processing
where we require non-negative values for packet_size_left.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
This commit is contained in:
Ronald S. Bultje 2012-02-17 12:21:18 -08:00
parent 74699ac8c8
commit 41afac7f7a
1 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
libavformat/asfdec.c
View File

@ -789,6 +789,13 @@ static int ff_asf_get_packet(AVFormatContext *s, AVIOContext *pb)
asf->packet_segments = 1; asf->packet_segments = 1;
asf->packet_segsizetype = 0x80; asf->packet_segsizetype = 0x80;
} }
if (rsize > packet_length - padsize) {
asf->packet_size_left = 0;
av_log(s, AV_LOG_ERROR,
"invalid packet header length %d for pktlen %d-%d at %"PRId64"\n",
rsize, packet_length, padsize, avio_tell(pb));
return -1;
}
asf->packet_size_left = packet_length - padsize - rsize; asf->packet_size_left = packet_length - padsize - rsize;
if (packet_length < asf->hdr.min_pktsize) if (packet_length < asf->hdr.min_pktsize)
padsize += asf->hdr.min_pktsize - packet_length; padsize += asf->hdr.min_pktsize - packet_length;