diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-03-18 17:30:53 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-03-18 17:30:53 +0100 |
| commit | 523c8e0503dcf99f67ea909dea2ca5e56d9ff091 (patch) | |
| tree | 1b9a5e34ff578050ac2818ede280be7dbd3be612 /libavformat/iff.c | |
| parent | 6abb554fd698d43726302b68999b96f429c7d3ba (diff) | |
| parent | 50c449ac24fbb4c03c15d2e2026cef2204b80385 (diff) | |
Merge commit '50c449ac24fbb4c03c15d2e2026cef2204b80385'
* commit '50c449ac24fbb4c03c15d2e2026cef2204b80385':
iff: validate CMAP palette size
asfenc: return error on negative timestamp
Conflicts:
libavformat/iff.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavformat/iff.c')
| -rw-r--r-- | libavformat/iff.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/libavformat/iff.c b/libavformat/iff.c index 5b0d3ff18d..1efc1472cc 100644 --- a/libavformat/iff.c +++ b/libavformat/iff.c @@ -250,8 +250,11 @@ static int iff_read_header(AVFormatContext *s) break; case ID_CMAP: - if (data_size > INT_MAX - IFF_EXTRA_VIDEO_SIZE - FF_INPUT_BUFFER_PADDING_SIZE) - return AVERROR_INVALIDDATA; + if (data_size < 3 || data_size > 768 || data_size % 3) { + av_log(s, AV_LOG_ERROR, "Invalid CMAP chunk size %d\n", + data_size); + return AVERROR_INVALIDDATA; + } st->codec->extradata_size = data_size + IFF_EXTRA_VIDEO_SIZE; st->codec->extradata = av_malloc(data_size + IFF_EXTRA_VIDEO_SIZE + FF_INPUT_BUFFER_PADDING_SIZE); if (!st->codec->extradata) |