diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-01-25 05:21:23 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-01-25 06:48:30 +0100 |
| commit | 28d634711b0cca18677a48d18416566b6565b567 (patch) | |
| tree | f5a12476410e6fab5545f6d4a047d4cbb8fe52ae /libavformat/avidec.c | |
| parent | 59e95fa4a8844d2abe7ddd7b8d269ea8d8eea17d (diff) | |
avidec: Fix regression with chunks that are larger than the file.
This commit makes the check specific to the case that needs it.
Regression was introduced by
commit 62adc60b97d854507d07a21b2f370ab5c69e6b7b
Author: Michael Niedermayer <michaelni@gmx.at>
Date: Fri Dec 16 06:13:04 2011 +0100
avidec: Check that the header chunks fit in the available filesize.
Fixes Ticket771
Bug found by: Diana Elena Muscalu
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavformat/avidec.c')
| -rw-r--r-- | libavformat/avidec.c | 7 |
1 files changed, 1 insertions, 6 deletions
diff --git a/libavformat/avidec.c b/libavformat/avidec.c index 86121b418c..ec2204c0a9 100644 --- a/libavformat/avidec.c +++ b/libavformat/avidec.c @@ -387,11 +387,6 @@ static int avi_read_header(AVFormatContext *s, AVFormatParameters *ap) tag = avio_rl32(pb); size = avio_rl32(pb); - if(size > avi->fsize){ - av_log(s, AV_LOG_ERROR, "chunk size is too big during header parsing\n"); - goto fail; - } - print_tag("tag", tag, size); switch(tag) { @@ -605,7 +600,7 @@ static int avi_read_header(AVFormatContext *s, AVFormatParameters *ap) break; } - if(size > 10*4 && size<(1<<30)){ + if(size > 10*4 && size<(1<<30) && size < avi->fsize){ st->codec->extradata_size= size - 10*4; st->codec->extradata= av_malloc(st->codec->extradata_size + FF_INPUT_BUFFER_PADDING_SIZE); if (!st->codec->extradata) { |