diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-05-21 20:16:35 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-05-21 20:34:32 +0200 |
| commit | 3230590c5dba41fcfbf27804b79ae5689bc2b413 (patch) | |
| tree | d04e023e4e5b54457c166d7cd7b50362a07e709e /libavcodec/avpacket.c | |
| parent | a1bb0823a96ee2d94c7c2f8080313e744ffbff5f (diff) | |
libavcodec: fix side data split with 0 sized packets
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/avpacket.c')
| -rw-r--r-- | libavcodec/avpacket.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libavcodec/avpacket.c b/libavcodec/avpacket.c index a8e5c643c9..612f02d9ed 100644 --- a/libavcodec/avpacket.c +++ b/libavcodec/avpacket.c @@ -259,7 +259,7 @@ int av_packet_split_side_data(AVPacket *pkt){ p = pkt->data + pkt->size - 8 - 5; for (i=1; ; i++){ size = AV_RB32(p); - if (size>INT_MAX || p - pkt->data <= size) + if (size>INT_MAX || p - pkt->data < size) return 0; if (p[4]&128) break; @@ -273,7 +273,7 @@ int av_packet_split_side_data(AVPacket *pkt){ p= pkt->data + pkt->size - 8 - 5; for (i=0; ; i++){ size= AV_RB32(p); - av_assert0(size<=INT_MAX && p - pkt->data > size); + av_assert0(size<=INT_MAX && p - pkt->data >= size); pkt->side_data[i].data = av_malloc(size + FF_INPUT_BUFFER_PADDING_SIZE); pkt->side_data[i].size = size; pkt->side_data[i].type = p[4]&127; |