diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2005-01-08 14:21:33 +0000 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2005-01-08 14:21:33 +0000 |
| commit | 568e18b15e2ddf494fd8926707d34ca08c8edce5 (patch) | |
| tree | 18f59992848e24c529a01bd98aed66af3762b2d1 /libavformat/grab.c | |
| parent | 934b0821dbb8fb33b2736fe4aab09fc2b6cc8ccc (diff) | |
integer overflows, heap corruption
possible arbitrary code execution cannot be ruled out in some cases
precautionary checks
Originally committed as revision 3813 to svn://svn.ffmpeg.org/ffmpeg/trunk
Diffstat (limited to 'libavformat/grab.c')
| -rw-r--r-- | libavformat/grab.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/libavformat/grab.c b/libavformat/grab.c index ded571b377..84284c132c 100644 --- a/libavformat/grab.c +++ b/libavformat/grab.c @@ -76,6 +76,9 @@ static int grab_read_header(AVFormatContext *s1, AVFormatParameters *ap) frame_rate = ap->frame_rate; frame_rate_base = ap->frame_rate_base; + if((unsigned)width > 32767 || (unsigned)height > 32767) + return -1; + st = av_new_stream(s1, 0); if (!st) return -ENOMEM; |