From ca402f32e392590a81a1381dab41c4f9c2c2f98a Mon Sep 17 00:00:00 2001 From: Max Horn Date: Tue, 12 Apr 2011 17:44:20 +0200 Subject: handle malloc failures in ff_get_wav_header ff_get_wav_header is reading data from a WAVE file and then uses it (without validation) to malloc a buffer. It then proceeded to read data into the buffer, without verifying that the allocation succeeded. To address this, change ff_get_wav_header to return an error if allocation failed, and adapted all calling code to handle that error. Signed-off-by: Luca Barbato --- libavformat/dxa.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'libavformat/dxa.c') diff --git a/libavformat/dxa.c b/libavformat/dxa.c index 7fec26fd9e..1e1d50581c 100644 --- a/libavformat/dxa.c +++ b/libavformat/dxa.c @@ -60,6 +60,7 @@ static int dxa_read_header(AVFormatContext *s, AVFormatParameters *ap) int w, h; int num, den; int flags; + int ret; tag = avio_rl32(pb); if (tag != MKTAG('D', 'E', 'X', 'A')) @@ -102,7 +103,9 @@ static int dxa_read_header(AVFormatContext *s, AVFormatParameters *ap) ast = av_new_stream(s, 0); if (!ast) return -1; - ff_get_wav_header(pb, ast->codec, fsize); + ret = ff_get_wav_header(pb, ast->codec, fsize); + if (ret < 0) + return ret; // find 'data' chunk while(avio_tell(pb) < c->vidpos && !pb->eof_reached){ tag = avio_rl32(pb); -- cgit v1.2.3