diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2016-02-11 22:12:36 +0100 |
|---|---|---|
| committer | Anton Khirnov <anton@khirnov.net> | 2016-07-25 13:56:57 +0200 |
| commit | 0e3964a45b97be25338ee39ed788d721c059f1e7 (patch) | |
| tree | 9d2c45acc446209fd9374378f7c4fd4c724e6bd1 | |
| parent | 6d5691c769abde4f5be8bdef007f17f3d5db14c4 (diff) | |
cfhd: Check the number of tag/value pairs
Fixes potentially long loop
Fixes: CID1351382/11
Reviewed-by: Kieran Kunhya <kieran@kunhya.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/cfhd.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/libavcodec/cfhd.c b/libavcodec/cfhd.c index 2436aae249..5ecfcefba5 100644 --- a/libavcodec/cfhd.c +++ b/libavcodec/cfhd.c @@ -344,6 +344,11 @@ static int cfhd_decode(AVCodecContext *avctx, void *data, int *got_frame, break; } else if (tag == 2) { av_log(avctx, AV_LOG_DEBUG, "tag=2 header - skipping %i tag/value pairs\n", data); + if (data > bytestream2_get_bytes_left(&gb) / 4) { + av_log(avctx, AV_LOG_ERROR, "too many tag/value pairs (%d)\n", data); + ret = AVERROR_INVALIDDATA; + break; + } for (i = 0; i < data; i++) { uint16_t tag2 = bytestream2_get_be16(&gb); uint16_t val2 = bytestream2_get_be16(&gb); |