From d1bec33b46091546c5b2e6815210e73f87abf413 Mon Sep 17 00:00:00 2001 From: Luca Barbato Date: Sun, 17 Mar 2013 15:13:43 +0100 Subject: asfenc: return error on negative timestamp According to the specification the timestamp is represented by a 32bit unsigned. CC: libav-stable@libav.org --- libavformat/asfenc.c | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'libavformat') diff --git a/libavformat/asfenc.c b/libavformat/asfenc.c index a523b3a051..6112d3f2e0 100644 --- a/libavformat/asfenc.c +++ b/libavformat/asfenc.c @@ -774,6 +774,14 @@ static int asf_write_packet(AVFormatContext *s, AVPacket *pkt) flags &= ~AV_PKT_FLAG_KEY; pts = (pkt->pts != AV_NOPTS_VALUE) ? pkt->pts : pkt->dts; + + if (pts < 0) { + av_log(s, AV_LOG_ERROR, + "Negative dts not supported stream %d, dts %"PRId64"\n", + pkt->stream_index, pts); + return AVERROR(ENOSYS); + } + assert(pts != AV_NOPTS_VALUE); duration = pts * 10000; asf->duration = FFMAX(asf->duration, duration + pkt->duration * 10000); -- cgit v1.2.3 From 50c449ac24fbb4c03c15d2e2026cef2204b80385 Mon Sep 17 00:00:00 2001 From: Kostya Shishkov Date: Sun, 17 Mar 2013 20:22:19 +0100 Subject: iff: validate CMAP palette size Fixes CVE-2013-2495 Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Luca Barbato CC: libav-stable@libav.org --- libavformat/iff.c | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'libavformat') diff --git a/libavformat/iff.c b/libavformat/iff.c index ab22e118f0..79f5f16050 100644 --- a/libavformat/iff.c +++ b/libavformat/iff.c @@ -166,6 +166,11 @@ static int iff_read_header(AVFormatContext *s) break; case ID_CMAP: + if (data_size < 3 || data_size > 768 || data_size % 3) { + av_log(s, AV_LOG_ERROR, "Invalid CMAP chunk size %d\n", + data_size); + return AVERROR_INVALIDDATA; + } st->codec->extradata_size = data_size; st->codec->extradata = av_malloc(data_size); if (!st->codec->extradata) -- cgit v1.2.3