diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-11-24 18:02:08 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-11-24 18:02:08 +0100 |
| commit | 57c0da6fe4ebd7c2d58a28248d84a18d45fce0ee (patch) | |
| tree | 1e46023fd27d0de4937643a62684648cfe61174f /libavcodec/smacker.c | |
| parent | 014058abeaa9da2c107a6348178431ea8c9b0bab (diff) | |
smacker: sanity check audio size.
Fixes, excessive memory allocation
Fixes Ticket1892
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/smacker.c')
| -rw-r--r-- | libavcodec/smacker.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/libavcodec/smacker.c b/libavcodec/smacker.c index f4cc6ae72b..dbcbbd54c8 100644 --- a/libavcodec/smacker.c +++ b/libavcodec/smacker.c @@ -608,6 +608,11 @@ static int smka_decode_frame(AVCodecContext *avctx, void *data, unp_size = AV_RL32(buf); + if (unp_size > (1U<<24)) { + av_log(avctx, AV_LOG_ERROR, "packet is too big\n"); + return AVERROR_INVALIDDATA; + } + init_get_bits(&gb, buf + 4, (buf_size - 4) * 8); if(!get_bits1(&gb)){ |