From bbc4d069d0ef70102a2e7e7b1c0d3a00f488e666 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Thu, 11 Feb 2016 22:12:36 +0100 Subject: [PATCH] avcodec/cfhd: Check the number of tag/value pairs Fixes potentially long loop Fixes: CID1351382/11 Reviewed-by: Kieran Kunhya Signed-off-by: Michael Niedermayer --- libavcodec/cfhd.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libavcodec/cfhd.c b/libavcodec/cfhd.c index 2436aae249..5ecfcefba5 100644 --- a/libavcodec/cfhd.c +++ b/libavcodec/cfhd.c @@ -344,6 +344,11 @@ static int cfhd_decode(AVCodecContext *avctx, void *data, int *got_frame, break; } else if (tag == 2) { av_log(avctx, AV_LOG_DEBUG, "tag=2 header - skipping %i tag/value pairs\n", data); + if (data > bytestream2_get_bytes_left(&gb) / 4) { + av_log(avctx, AV_LOG_ERROR, "too many tag/value pairs (%d)\n", data); + ret = AVERROR_INVALIDDATA; + break; + } for (i = 0; i < data; i++) { uint16_t tag2 = bytestream2_get_be16(&gb); uint16_t val2 = bytestream2_get_be16(&gb);