diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-09-16 12:05:42 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-09-16 12:15:42 +0200 |
| commit | a444ddff03861b092558aa0b1b38b218fc636aaa (patch) | |
| tree | 4786f55ecb2d7345b7cf225d62bc91181b58509c /libavformat/omadec.c | |
| parent | 97f8d9feb75dbb0a6ab7a0d670441583b3d85e0e (diff) | |
| parent | 342c43d154e586bc022c86b168fe8d36f69da9d3 (diff) | |
Merge commit '342c43d154e586bc022c86b168fe8d36f69da9d3'
* commit '342c43d154e586bc022c86b168fe8d36f69da9d3':
omadec: Properly check lengths before incrementing the position
See: f1d6f013b2078140fb701978d720abecde7cd73f
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavformat/omadec.c')
| -rw-r--r-- | libavformat/omadec.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/libavformat/omadec.c b/libavformat/omadec.c index fd7eb0bf7f..d0cb6d49a7 100644 --- a/libavformat/omadec.c +++ b/libavformat/omadec.c @@ -171,7 +171,11 @@ static int nprobe(AVFormatContext *s, uint8_t *enc_header, unsigned size, taglen = AV_RB32(&enc_header[pos + 32]); datalen = AV_RB32(&enc_header[pos + 36]) >> 4; - pos += 44 + taglen; + pos += 44; + if (size - pos < taglen) + return -1; + + pos += taglen; if (pos + (((uint64_t)datalen) << 4) > size) return -1; |