diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-11-17 19:56:26 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-11-17 20:43:56 +0100 |
| commit | fb1ea777b3a01be6d71a103529ad37982707cacc (patch) | |
| tree | 394b5fc6c744245d682e48ad4f02030fd1101d11 /libavformat/electronicarts.c | |
| parent | 461ecea0680606875cb28a6b98ac1df25ae8a3c6 (diff) | |
electronicarts: check size before reading duration out of a chunk.
Fixes null pointer dereference
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavformat/electronicarts.c')
| -rw-r--r-- | libavformat/electronicarts.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/libavformat/electronicarts.c b/libavformat/electronicarts.c index 82bc0e246d..5b821a9cf5 100644 --- a/libavformat/electronicarts.c +++ b/libavformat/electronicarts.c @@ -545,10 +545,12 @@ static int ea_read_packet(AVFormatContext *s, case AV_CODEC_ID_ADPCM_EA_R1: case AV_CODEC_ID_ADPCM_EA_R2: case AV_CODEC_ID_ADPCM_IMA_EA_EACS: - pkt->duration = AV_RL32(pkt->data); + if (pkt->size >= 4) + pkt->duration = AV_RL32(pkt->data); break; case AV_CODEC_ID_ADPCM_EA_R3: - pkt->duration = AV_RB32(pkt->data); + if (pkt->size >= 4) + pkt->duration = AV_RB32(pkt->data); break; case AV_CODEC_ID_ADPCM_IMA_EA_SEAD: pkt->duration = ret * 2 / ea->num_channels; |