diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-10-04 14:29:59 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-10-04 14:30:05 +0200 |
| commit | 74b2b0ed9fc3d74cc19696121dd09f3e8ca25e31 (patch) | |
| tree | 86d982416e2376b4c3e80e1f97d60b04a9f2fec4 /libavformat/rtmpproto.c | |
| parent | 5bb3ef3b369a7be87c25f3a9050edd4e7c2364d8 (diff) | |
| parent | cd818b3a5709b9b08bd5901cb8863a8b61be265e (diff) | |
Merge commit 'cd818b3a5709b9b08bd5901cb8863a8b61be265e'
* commit 'cd818b3a5709b9b08bd5901cb8863a8b61be265e':
rtmpproto: Validate the embedded flv packet size before copying
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavformat/rtmpproto.c')
| -rw-r--r-- | libavformat/rtmpproto.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/libavformat/rtmpproto.c b/libavformat/rtmpproto.c index e7d29aa3c7..9b0963b170 100644 --- a/libavformat/rtmpproto.c +++ b/libavformat/rtmpproto.c @@ -2218,6 +2218,8 @@ static int handle_metadata(RTMPContext *rt, RTMPPacket *pkt) pts = cts; ts += cts - pts; pts = cts; + if (size + 3 + 4 > pkt->data + pkt->size - next) + break; bytestream_put_byte(&p, type); bytestream_put_be24(&p, size); bytestream_put_be24(&p, ts); |