RepoMirrors/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2025-01-11 18:09:36 +00:00
Code Issues Projects Releases Wiki Activity

Merge commit 'c0a49077ea4ff3a0ad30b9e33f1bb06ba9112aaa'

Browse Source 
* commit 'c0a49077ea4ff3a0ad30b9e33f1bb06ba9112aaa':
  asfdec: add more checks for size left in asf packet buffer

Merged-by: Hendrik Leppkes <h.leppkes@gmail.com>
This commit is contained in:
Hendrik Leppkes 2015-09-12 15:18:05 +02:00
commit de969904b1
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
libavformat/asfdec_o.c
View File

@ -1141,7 +1141,7 @@ static int asf_read_replicated_data(AVFormatContext *s, ASFPacket *asf_pkt)
if (!asf_pkt->data_size) {
asf_pkt->data_size = asf_pkt->size_left = avio_rl32(pb); // read media object size
if (asf_pkt->data_size <= 0)
return AVERROR_EOF;
return AVERROR_INVALIDDATA;
if ((ret = av_new_packet(&asf_pkt->avpkt, asf_pkt->data_size)) < 0)
return ret;
} else
@ -1190,6 +1190,8 @@ static int asf_read_multiple_payload(AVFormatContext *s, AVPacket *pkt,
skip = pay_len - asf_pkt->size_left;
pay_len = asf_pkt->size_left;
}
if (asf_pkt->size_left <= 0)
return AVERROR_INVALIDDATA;
if ((ret = avio_read(pb, p, pay_len)) < 0)
return ret;
if (s->key && s->keylen == 20)
@ -1237,7 +1239,7 @@ static int asf_read_single_payload(AVFormatContext *s, AVPacket *pkt,
return AVERROR_INVALIDDATA;
}
p = asf_pkt->avpkt.data + asf_pkt->data_size - asf_pkt->size_left;
if (size > asf_pkt->size_left)
if (size > asf_pkt->size_left || asf_pkt->size_left <= 0)
return AVERROR_INVALIDDATA;
if (asf_pkt->size_left > size)
asf_pkt->size_left -= size;