summaryrefslogtreecommitdiffstats
path: root/libavformat
diff options
context:
space:
mode:
authorMartin Storsjö <martin@martin.st>2013-09-19 16:55:13 +0300
committerMartin Storsjö <martin@martin.st>2013-09-19 22:46:35 +0300
commit83c285f88016b087c2f0f4b9ef356ad8ef12d947 (patch)
tree6447f135725834d7c809a2715fc527233051bba7 /libavformat
parentd8b68660145c76a23fc9665f96932449514ecad2 (diff)
downloadffmpeg-streaming-83c285f88016b087c2f0f4b9ef356ad8ef12d947.zip
ffmpeg-streaming-83c285f88016b087c2f0f4b9ef356ad8ef12d947.tar.gz
wtv: Add more sanity checks for a length read from the file
Also make sure the existing length check can't overflow. Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-stable@libav.org Signed-off-by: Martin Storsjö <martin@martin.st>
Diffstat (limited to 'libavformat')
-rw-r--r--libavformat/wtv.c7
1 files changed, 6 insertions, 1 deletions
diff --git a/libavformat/wtv.c b/libavformat/wtv.c
index b003905..5099739 100644
--- a/libavformat/wtv.c
+++ b/libavformat/wtv.c
@@ -269,7 +269,12 @@ static AVIOContext * wtvfile_open2(AVFormatContext *s, const uint8_t *buf, int b
dir_length = AV_RL16(buf + 16);
file_length = AV_RL64(buf + 24);
name_size = 2 * AV_RL32(buf + 32);
- if (buf + 48 + name_size > buf_end) {
+ if (name_size < 0) {
+ av_log(s, AV_LOG_ERROR,
+ "bad filename length, remaining directory entries ignored\n");
+ break;
+ }
+ if (48 + name_size > buf_end - buf) {
av_log(s, AV_LOG_ERROR, "filename exceeds buffer size; remaining directory entries ignored\n");
break;
}
OpenPOWER on IntegriCloud