github-mirrors/FFmpeg
1
0
Fork 0
mirror of https://mirror.skon.top/https://github.com/FFmpeg/FFmpeg synced 2026-05-01 06:13:08 +08:00
Code Issues Packages Projects Releases Wiki Activity

smackerdemuxer: check some values before instead of just after malloc()

Browse Source 
Fixes Ticket777
Bug Found by: Diana Elena Muscalu

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit c402c1c976)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer
2011-12-16 02:57:22 +01:00
parent 42f8a33c3c
commit 127a290253
1 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
libavformat/smacker.c
View File

@@ -251,6 +251,8 @@ static int smacker_read_packet(AVFormatContext *s, AVPacket *pkt)
memcpy(oldpal, pal, 768);
size = avio_r8(s->pb);
size = size * 4 - 1;
if(size + 1 > frame_size)
return AVERROR_INVALIDDATA;
frame_size -= size;
frame_size--;
sz = 0;
@@ -292,10 +294,12 @@ static int smacker_read_packet(AVFormatContext *s, AVPacket *pkt)
/* if audio chunks are present, put them to stack and retrieve later */
for(i = 0; i < 7; i++) {
if(flags & 1) {
int size;
unsigned int size;
uint8_t *tmpbuf;
size = avio_rl32(s->pb) - 4;
if(size + 4L > frame_size)
return AVERROR_INVALIDDATA;
frame_size -= size;
frame_size -= 4;
smk->curstream++;