RepoMirrors/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2025-01-06 15:21:15 +00:00
Code Issues Projects Releases Wiki Activity

avformat/mvdec: Check size for validity in var_read_string()

Browse Source 
Fixes out of array read
Fixes: asan_heap-oob_49b1e5_12_011.movie
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2014-10-28 16:42:05 +01:00
parent e70312dfc2
commit 86e5749285
1 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
libavformat/mvdec.c
View File

@ -57,7 +57,12 @@ static int mv_probe(AVProbeData *p)
static char *var_read_string(AVIOContext *pb, int size) static char *var_read_string(AVIOContext *pb, int size)
{ {
int n; int n;
char *str = av_malloc(size + 1); char *str;
if (size < 0 || size == INT_MAX)
return NULL;
str = av_malloc(size + 1);
if (!str) if (!str)
return NULL; return NULL;
n = avio_get_str(pb, size, str, size + 1); n = avio_get_str(pb, size, str, size + 1);