diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-09-20 14:13:52 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-09-20 14:21:34 +0200 |
| commit | 9bb86faca7936f6dba93aa3b11fc24f19c7878a4 (patch) | |
| tree | 2c0eebe5760e9d56064d6a8030da052885af2523 /libavcodec/fraps.c | |
| parent | c188c10805aa62d0cdeb5b5ecfba5fa4aec9c47d (diff) | |
| parent | 3185a80259ce1f8f8111073dbd14a69a396e03a3 (diff) | |
Merge commit '3185a80259ce1f8f8111073dbd14a69a396e03a3'
* commit '3185a80259ce1f8f8111073dbd14a69a396e03a3':
fraps: Make the input buffer size checks more strict
Conflicts:
libavcodec/fraps.c
The added checks are mostly to handle duplicate frames, which
we discard, thus there are also no P frames for example.
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/fraps.c')
| -rw-r--r-- | libavcodec/fraps.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/libavcodec/fraps.c b/libavcodec/fraps.c index a1d5a17777..bdbe511d8d 100644 --- a/libavcodec/fraps.c +++ b/libavcodec/fraps.c @@ -143,6 +143,11 @@ static int decode_frame(AVCodecContext *avctx, const int planes = 3; uint8_t *out; + if (buf_size < 4) { + av_log(avctx, AV_LOG_ERROR, "Packet is too short\n"); + return AVERROR_INVALIDDATA; + } + header = AV_RL32(buf); version = header & 0xff; header_size = (header & (1<<30))? 8 : 4; /* bit 30 means pad to 8 bytes */ |