diff options
| author | Hendrik Leppkes <h.leppkes@gmail.com> | 2015-09-12 15:18:05 +0200 |
|---|---|---|
| committer | Hendrik Leppkes <h.leppkes@gmail.com> | 2015-09-12 15:18:05 +0200 |
| commit | de969904b18b438120be8b5bf99a351aa55db545 (patch) | |
| tree | 838a494befe8eb78e59981acd5a712b2ab77d3e7 /libavformat | |
| parent | 73e9f04ea5e80e7b99420ec4bbf6995430146ff8 (diff) | |
| parent | c0a49077ea4ff3a0ad30b9e33f1bb06ba9112aaa (diff) | |
Merge commit 'c0a49077ea4ff3a0ad30b9e33f1bb06ba9112aaa'
* commit 'c0a49077ea4ff3a0ad30b9e33f1bb06ba9112aaa':
asfdec: add more checks for size left in asf packet buffer
Merged-by: Hendrik Leppkes <h.leppkes@gmail.com>
Diffstat (limited to 'libavformat')
| -rw-r--r-- | libavformat/asfdec_o.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/libavformat/asfdec_o.c b/libavformat/asfdec_o.c index db559f6c2b..cf2a01e6db 100644 --- a/libavformat/asfdec_o.c +++ b/libavformat/asfdec_o.c @@ -1141,7 +1141,7 @@ static int asf_read_replicated_data(AVFormatContext *s, ASFPacket *asf_pkt) if (!asf_pkt->data_size) { asf_pkt->data_size = asf_pkt->size_left = avio_rl32(pb); // read media object size if (asf_pkt->data_size <= 0) - return AVERROR_EOF; + return AVERROR_INVALIDDATA; if ((ret = av_new_packet(&asf_pkt->avpkt, asf_pkt->data_size)) < 0) return ret; } else @@ -1190,6 +1190,8 @@ static int asf_read_multiple_payload(AVFormatContext *s, AVPacket *pkt, skip = pay_len - asf_pkt->size_left; pay_len = asf_pkt->size_left; } + if (asf_pkt->size_left <= 0) + return AVERROR_INVALIDDATA; if ((ret = avio_read(pb, p, pay_len)) < 0) return ret; if (s->key && s->keylen == 20) @@ -1237,7 +1239,7 @@ static int asf_read_single_payload(AVFormatContext *s, AVPacket *pkt, return AVERROR_INVALIDDATA; } p = asf_pkt->avpkt.data + asf_pkt->data_size - asf_pkt->size_left; - if (size > asf_pkt->size_left) + if (size > asf_pkt->size_left || asf_pkt->size_left <= 0) return AVERROR_INVALIDDATA; if (asf_pkt->size_left > size) asf_pkt->size_left -= size; |