From 7f05c164d8ccbfded9bcefdb41942bc28d85c87a Mon Sep 17 00:00:00 2001 From: Peter Ross Date: Sun, 13 Mar 2011 16:15:38 +1100 Subject: jv demuxer: prevent video packet size overflow In the event of overflow, the JV_PADDING state will avio_skip over any overflow bytes (using JVFrame.total_size). Signed-off-by: Ronald S. Bultje --- libavformat/jvdec.c | 2 ++ 1 file changed, 2 insertions(+) (limited to 'libavformat/jvdec.c') diff --git a/libavformat/jvdec.c b/libavformat/jvdec.c index 314a341ac6..9235e51a99 100644 --- a/libavformat/jvdec.c +++ b/libavformat/jvdec.c @@ -116,6 +116,8 @@ static int read_header(AVFormatContext *s, jvf->audio_size = avio_rl32(pb); jvf->video_size = avio_rl32(pb); jvf->palette_size = avio_r8(pb) ? 768 : 0; + jvf->video_size = FFMIN(FFMAX(jvf->video_size, 0), + INT_MAX - JV_PREAMBLE_SIZE - jvf->palette_size); if (avio_r8(pb)) av_log(s, AV_LOG_WARNING, "unsupported audio codec\n"); jvf->video_type = avio_r8(pb); -- cgit v1.2.3