mirror of https://git.ffmpeg.org/ffmpeg.git
avcodec/avpacket: Fix off by 5 error
Fixes out of array read Fixes: mozilla bug 1266129 Found-by: Tyson Smith Tested-by: Tyson Smith Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
parent
38797a8033
commit
9f36ea57ae
|
@ -403,10 +403,12 @@ int av_packet_split_side_data(AVPacket *pkt){
|
||||||
p = pkt->data + pkt->size - 8 - 5;
|
p = pkt->data + pkt->size - 8 - 5;
|
||||||
for (i=1; ; i++){
|
for (i=1; ; i++){
|
||||||
size = AV_RB32(p);
|
size = AV_RB32(p);
|
||||||
if (size>INT_MAX || p - pkt->data < size)
|
if (size>INT_MAX - 5 || p - pkt->data < size)
|
||||||
return 0;
|
return 0;
|
||||||
if (p[4]&128)
|
if (p[4]&128)
|
||||||
break;
|
break;
|
||||||
|
if (p - pkt->data < size + 5)
|
||||||
|
return 0;
|
||||||
p-= size+5;
|
p-= size+5;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -417,7 +419,7 @@ int av_packet_split_side_data(AVPacket *pkt){
|
||||||
p= pkt->data + pkt->size - 8 - 5;
|
p= pkt->data + pkt->size - 8 - 5;
|
||||||
for (i=0; ; i++){
|
for (i=0; ; i++){
|
||||||
size= AV_RB32(p);
|
size= AV_RB32(p);
|
||||||
av_assert0(size<=INT_MAX && p - pkt->data >= size);
|
av_assert0(size<=INT_MAX - 5 && p - pkt->data >= size);
|
||||||
pkt->side_data[i].data = av_mallocz(size + AV_INPUT_BUFFER_PADDING_SIZE);
|
pkt->side_data[i].data = av_mallocz(size + AV_INPUT_BUFFER_PADDING_SIZE);
|
||||||
pkt->side_data[i].size = size;
|
pkt->side_data[i].size = size;
|
||||||
pkt->side_data[i].type = p[4]&127;
|
pkt->side_data[i].type = p[4]&127;
|
||||||
|
|
Loading…
Reference in New Issue