diff options
author | Michael Niedermayer <michaelni@gmx.at> | 2005-01-08 14:21:33 +0000 |
---|---|---|
committer | Michael Niedermayer <michaelni@gmx.at> | 2005-01-08 14:21:33 +0000 |
commit | 568e18b15e2ddf494fd8926707d34ca08c8edce5 (patch) | |
tree | 18f59992848e24c529a01bd98aed66af3762b2d1 /libavformat/aviobuf.c | |
parent | 934b0821dbb8fb33b2736fe4aab09fc2b6cc8ccc (diff) | |
download | ffmpeg-streaming-568e18b15e2ddf494fd8926707d34ca08c8edce5.zip ffmpeg-streaming-568e18b15e2ddf494fd8926707d34ca08c8edce5.tar.gz |
integer overflows, heap corruption
possible arbitrary code execution cannot be ruled out in some cases
precautionary checks
Originally committed as revision 3813 to svn://svn.ffmpeg.org/ffmpeg/trunk
Diffstat (limited to 'libavformat/aviobuf.c')
-rw-r--r-- | libavformat/aviobuf.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/libavformat/aviobuf.c b/libavformat/aviobuf.c index 31c6a7f..bb55254 100644 --- a/libavformat/aviobuf.c +++ b/libavformat/aviobuf.c @@ -629,11 +629,13 @@ static int dyn_buf_write(void *opaque, uint8_t *buf, int buf_size) /* reallocate buffer if needed */ new_size = d->pos + buf_size; new_allocated_size = d->allocated_size; + if(new_size < d->pos || new_size > INT_MAX/2) + return -1; while (new_size > new_allocated_size) { if (!new_allocated_size) new_allocated_size = new_size; else - new_allocated_size = (new_allocated_size * 3) / 2 + 1; + new_allocated_size += new_allocated_size / 2 + 1; } if (new_allocated_size > d->allocated_size) { @@ -691,6 +693,8 @@ static int url_open_dyn_buf_internal(ByteIOContext *s, int max_packet_size) else io_buffer_size = 1024; + if(sizeof(DynBuffer) + io_buffer_size < io_buffer_size) + return -1; d = av_malloc(sizeof(DynBuffer) + io_buffer_size); if (!d) return -1; |