diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2011-12-24 22:06:25 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2011-12-24 22:06:25 +0100 |
| commit | 47c4713a23d271eedd2eb2c02daa70cb0ea4e0ac (patch) | |
| tree | 116d0bffad83ad24341f534dae9e38983a3606f2 /libavformat/sierravmd.c | |
| parent | 2278ecc434d390bccd32a083a12ab964a6b7b0ce (diff) | |
sierravmd: limit packetsize to the amount that could be read.
Fixes huge allocations.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavformat/sierravmd.c')
| -rw-r--r-- | libavformat/sierravmd.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/libavformat/sierravmd.c b/libavformat/sierravmd.c index faf97b2d6a..f614e51b5c 100644 --- a/libavformat/sierravmd.c +++ b/libavformat/sierravmd.c @@ -30,6 +30,7 @@ #include "libavutil/intreadwrite.h" #include "avformat.h" #include "internal.h" +#include "avio_internal.h" #define VMD_HEADER_SIZE 0x0330 #define BYTES_PER_FRAME_RECORD 16 @@ -246,6 +247,8 @@ static int vmd_read_packet(AVFormatContext *s, /* position the stream (will probably be there already) */ avio_seek(pb, frame->frame_offset, SEEK_SET); + if(ffio_limit(pb, frame->frame_size) != frame->frame_size) + return AVERROR(EIO); if (av_new_packet(pkt, frame->frame_size + BYTES_PER_FRAME_RECORD)) return AVERROR(ENOMEM); pkt->pos= avio_tell(pb); |