diff options
author | Michael Niedermayer <michaelni@gmx.at> | 2011-12-25 12:31:23 +0100 |
---|---|---|
committer | Michael Niedermayer <michaelni@gmx.at> | 2011-12-25 18:55:43 +0100 |
commit | 5e9a56a0350c518cd4b38845aff49d41a9c952ae (patch) | |
tree | d08616fbded79b2c1935c34827d325073e9cec2e /libavcodec/shorten.c | |
parent | 18bcfc912e48bf77a5202a0e24a3b884b9b2ff2c (diff) | |
download | ffmpeg-streaming-5e9a56a0350c518cd4b38845aff49d41a9c952ae.zip ffmpeg-streaming-5e9a56a0350c518cd4b38845aff49d41a9c952ae.tar.gz |
shorten: validate values in fmt chunk search
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/shorten.c')
-rw-r--r-- | libavcodec/shorten.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/libavcodec/shorten.c b/libavcodec/shorten.c index 1906c69..ef58aaa 100644 --- a/libavcodec/shorten.c +++ b/libavcodec/shorten.c @@ -205,7 +205,7 @@ static int decode_wave_header(AVCodecContext *avctx, const uint8_t *header, { int len; short wave_format; - + const uint8_t *end= header + header_size; if (bytestream_get_le32(&header) != MKTAG('R','I','F','F')) { av_log(avctx, AV_LOG_ERROR, "missing RIFF tag\n"); @@ -221,6 +221,8 @@ static int decode_wave_header(AVCodecContext *avctx, const uint8_t *header, while (bytestream_get_le32(&header) != MKTAG('f','m','t',' ')) { len = bytestream_get_le32(&header); + if(len<0 || end - header - 8 < len) + return AVERROR_INVALIDDATA; header += len; } len = bytestream_get_le32(&header); |