mirror of https://git.ffmpeg.org/ffmpeg.git
avformat/rl2: Fix DoS due to lack of eof check
Fixes: loop.rl2
Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 96f24d1bee
)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
parent
983f90ef18
commit
2ac9bc3497
|
@ -170,12 +170,21 @@ static av_cold int rl2_read_header(AVFormatContext *s)
|
||||||
}
|
}
|
||||||
|
|
||||||
/** read offset and size tables */
|
/** read offset and size tables */
|
||||||
for(i=0; i < frame_count;i++)
|
for(i=0; i < frame_count;i++) {
|
||||||
|
if (avio_feof(pb))
|
||||||
|
return AVERROR_INVALIDDATA;
|
||||||
chunk_size[i] = avio_rl32(pb);
|
chunk_size[i] = avio_rl32(pb);
|
||||||
for(i=0; i < frame_count;i++)
|
}
|
||||||
|
for(i=0; i < frame_count;i++) {
|
||||||
|
if (avio_feof(pb))
|
||||||
|
return AVERROR_INVALIDDATA;
|
||||||
chunk_offset[i] = avio_rl32(pb);
|
chunk_offset[i] = avio_rl32(pb);
|
||||||
for(i=0; i < frame_count;i++)
|
}
|
||||||
|
for(i=0; i < frame_count;i++) {
|
||||||
|
if (avio_feof(pb))
|
||||||
|
return AVERROR_INVALIDDATA;
|
||||||
audio_size[i] = avio_rl32(pb) & 0xFFFF;
|
audio_size[i] = avio_rl32(pb) & 0xFFFF;
|
||||||
|
}
|
||||||
|
|
||||||
/** build the sample index */
|
/** build the sample index */
|
||||||
for(i=0;i<frame_count;i++){
|
for(i=0;i<frame_count;i++){
|
||||||
|
|
Loading…
Reference in New Issue