diff options
author | Michael Niedermayer <michaelni@gmx.at> | 2015-05-11 15:37:38 +0200 |
---|---|---|
committer | Michael Niedermayer <michaelni@gmx.at> | 2015-05-11 15:56:16 +0200 |
commit | 66f26b3e8ec075298e7ba329a55893d085bafe96 (patch) | |
tree | 1e75492414598ec7fe7ed19ed4ed7c4f1c35e96f | |
parent | 0db5b2b9f8a96298eeba7988d43c4eb44220fab3 (diff) | |
download | ffmpeg-streaming-66f26b3e8ec075298e7ba329a55893d085bafe96.zip ffmpeg-streaming-66f26b3e8ec075298e7ba329a55893d085bafe96.tar.gz |
avformat/matroskaenc: Check ff_vorbiscomment_length in put_flac_codecpriv()
Its currently guaranteed to be smaller but its safer to check anyway
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
-rw-r--r-- | libavformat/matroskaenc.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/libavformat/matroskaenc.c b/libavformat/matroskaenc.c index 4e87eb0..7cbba0b 100644 --- a/libavformat/matroskaenc.c +++ b/libavformat/matroskaenc.c @@ -546,12 +546,15 @@ static int put_flac_codecpriv(AVFormatContext *s, "Lavf" : LIBAVFORMAT_IDENT; AVDictionary *dict = NULL; uint8_t buf[32], *data, *p; - int len; + int64_t len; snprintf(buf, sizeof(buf), "0x%"PRIx64, codec->channel_layout); av_dict_set(&dict, "WAVEFORMATEXTENSIBLE_CHANNEL_MASK", buf, 0); len = ff_vorbiscomment_length(dict, vendor); + if (len >= ((1<<24) - 4)) + return AVERROR(EINVAL); + data = av_malloc(len + 4); if (!data) { av_dict_free(&dict); |