diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2016-02-11 22:12:36 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2016-02-12 01:52:44 +0100 |
| commit | bbc4d069d0ef70102a2e7e7b1c0d3a00f488e666 (patch) | |
| tree | 0c99f02103b71df75a72e1b15e2fb89531fbef4a /libavcodec/cfhd.c | |
| parent | 156013111a3389a3f0c1af33dfaa008824e30727 (diff) | |
avcodec/cfhd: Check the number of tag/value pairs
Fixes potentially long loop
Fixes: CID1351382/11
Reviewed-by: Kieran Kunhya <kieran@kunhya.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec/cfhd.c')
| -rw-r--r-- | libavcodec/cfhd.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/libavcodec/cfhd.c b/libavcodec/cfhd.c index 2436aae249..5ecfcefba5 100644 --- a/libavcodec/cfhd.c +++ b/libavcodec/cfhd.c @@ -344,6 +344,11 @@ static int cfhd_decode(AVCodecContext *avctx, void *data, int *got_frame, break; } else if (tag == 2) { av_log(avctx, AV_LOG_DEBUG, "tag=2 header - skipping %i tag/value pairs\n", data); + if (data > bytestream2_get_bytes_left(&gb) / 4) { + av_log(avctx, AV_LOG_ERROR, "too many tag/value pairs (%d)\n", data); + ret = AVERROR_INVALIDDATA; + break; + } for (i = 0; i < data; i++) { uint16_t tag2 = bytestream2_get_be16(&gb); uint16_t val2 = bytestream2_get_be16(&gb); |