diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2014-01-31 17:21:32 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2014-01-31 17:22:48 +0100 |
| commit | fff2953163ff466d5391b2f862bd2216fbe728b2 (patch) | |
| tree | d077f7c78bd78537e6ea080473e40fb80980405e /libavformat/flac_picture.c | |
| parent | aa36dcf53441a0835f45bc8667de9b157f064809 (diff) | |
avformat/flac_picture: allocate buffer padding for picture
Fixes: heap array overread
Fixes: asan_heap-oob_14876d9_4706_cov_815472558_cover_art.flac
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavformat/flac_picture.c')
| -rw-r--r-- | libavformat/flac_picture.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavformat/flac_picture.c b/libavformat/flac_picture.c index 12d73e488f..a58b3055c8 100644 --- a/libavformat/flac_picture.c +++ b/libavformat/flac_picture.c @@ -107,7 +107,7 @@ int ff_flac_parse_picture(AVFormatContext *s, uint8_t *buf, int buf_size) ret = AVERROR_INVALIDDATA; goto fail; } - if (!(data = av_buffer_alloc(len))) { + if (!(data = av_buffer_alloc(len + FF_INPUT_BUFFER_PADDING_SIZE))) { RETURN_ERROR(AVERROR(ENOMEM)); } if (avio_read(pb, data->data, len) != len) { |