RepoMirrors/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2024-12-29 19:02:21 +00:00
Code Issues Projects Releases Wiki Activity

avformat/swfdec: Move packet size check before side data allocation

Browse Source 
Fixes memleak
Fixes: 9eb9cf5b8c26dd0fa7107ed0348dcc1f/signal_sigabrt_7ffff6ae7c37_8927_f14c2a6ae1ad0bbde2c94f1da50e7074.swf

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2016-08-19 03:04:57 +02:00
parent 237207645b
commit 2a3720bc22
1 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
libavformat/swfdec.c
View File

@ -395,6 +395,11 @@ static int swf_read_packet(AVFormatContext *s, AVPacket *pkt)
pkt->pos = pos;
pkt->stream_index = st->index;
if (linesize * height > pkt->size) {
res = AVERROR_INVALIDDATA;
goto bitmap_end;
}
switch (bmp_fmt) {
case 3:
pix_fmt = AV_PIX_FMT_PAL8;
@ -422,10 +427,6 @@ static int swf_read_packet(AVFormatContext *s, AVPacket *pkt)
} else
st->codecpar->format = pix_fmt;
if (linesize * height > pkt->size) {
res = AVERROR_INVALIDDATA;
goto bitmap_end;
}
memcpy(pkt->data, buf + colormapsize*colormapbpp, linesize * height);
res = pkt->size;