RepoMirrors/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2024-12-24 16:22:37 +00:00
Code Issues Projects Releases Wiki Activity

avformat/rtpdec_xiph: Check upper bound on len in xiph_handle_packet()

Browse Source 
Larger packets are not supported and would cause problems later

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit aa5169935e)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2015-05-12 18:03:55 +02:00
parent 9c10c0fdcd
commit 1973b6ac5c
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
libavformat/rtpdec_xiph.c
View File

@ -112,7 +112,7 @@ static int xiph_handle_packet(AVFormatContext *ctx, PayloadContext *data,
return data->split_pkts > 0; return data->split_pkts > 0;
} }
if (len < 6) { if (len < 6 || len > INT_MAX/2) {
av_log(ctx, AV_LOG_ERROR, "Invalid %d byte packet\n", len); av_log(ctx, AV_LOG_ERROR, "Invalid %d byte packet\n", len);
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
} }