diff options
| author | Samuel Pitoiset <samuel.pitoiset@gmail.com> | 2012-07-26 14:05:18 +0200 |
|---|---|---|
| committer | Martin Storsjö <martin@martin.st> | 2012-07-26 22:56:54 +0300 |
| commit | 2357f606876173a25acf3130868e374cc44c5f47 (patch) | |
| tree | 0303db9c3d9a3e311461e1734ca1a1e54f06b54f /libavformat/rtmpproto.c | |
| parent | 44dc9c6af0377faf2a99889d1f949e32a1102e84 (diff) | |
rtmp: Prevent reading outside of an allocate buffer when receiving server bandwidth packets
Signed-off-by: Martin Storsjö <martin@martin.st>
Diffstat (limited to 'libavformat/rtmpproto.c')
| -rw-r--r-- | libavformat/rtmpproto.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/libavformat/rtmpproto.c b/libavformat/rtmpproto.c index a2efe3882f..183afae4e8 100644 --- a/libavformat/rtmpproto.c +++ b/libavformat/rtmpproto.c @@ -950,6 +950,13 @@ static int handle_server_bw(URLContext *s, RTMPPacket *pkt) { RTMPContext *rt = s->priv_data; + if (pkt->data_size < 4) { + av_log(s, AV_LOG_ERROR, + "Too short server bandwidth report packet (%d)\n", + pkt->data_size); + return AVERROR_INVALIDDATA; + } + rt->server_bw = AV_RB32(pkt->data); if (rt->server_bw <= 0) { av_log(s, AV_LOG_ERROR, "Incorrect server bandwidth %d\n", |