RepoMirrors/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2024-12-25 00:32:31 +00:00
Code Issues Projects Releases Wiki Activity

avformat/vividas: check if value from ffio_read_varlen() is too big

Browse Source
This commit is contained in:
Paul B Mahol 2018-12-22 10:37:55 +01:00
parent 53d3a1c514
commit 297e65c676
1 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
libavformat/vividas.c
View File

@ -618,9 +618,11 @@ static int viv_read_packet(AVFormatContext *s,
off += viv->sb_entries[viv->current_sb_entry].size; off += viv->sb_entries[viv->current_sb_entry].size;
if (viv->sb_entries[viv->current_sb_entry].flag == 0) { if (viv->sb_entries[viv->current_sb_entry].flag == 0) {
int v_size = ffio_read_varlen(pb); uint64_t v_size = ffio_read_varlen(pb);
ffio_read_varlen(pb); ffio_read_varlen(pb);
if (v_size > INT_MAX)
return AVERROR_INVALIDDATA;
ret = av_get_packet(pb, pkt, v_size); ret = av_get_packet(pb, pkt, v_size);
if (ret < 0) if (ret < 0)
return ret; return ret;
@ -646,8 +648,10 @@ static int viv_read_packet(AVFormatContext *s,
viv->current_audio_subpacket = 0; viv->current_audio_subpacket = 0;
} else { } else {
int v_size = ffio_read_varlen(pb); uint64_t v_size = ffio_read_varlen(pb);
if (v_size > INT_MAX)
return AVERROR_INVALIDDATA;
ret = av_get_packet(pb, pkt, v_size); ret = av_get_packet(pb, pkt, v_size);
if (ret < 0) if (ret < 0)
return ret; return ret;