Module: libav Branch: release/0.7 Commit: 7fc9aa6d359e6c594a367e4db6366bc661581f56
Author: Justin Ruggles <[email protected]> Committer: Reinhard Tartler <[email protected]> Date: Tue Sep 13 15:13:44 2011 -0400 flacdec: fix buffer size checking in get_metadata_size() Adds an additional check before reading the next block header and avoids a potential integer overflow when checking the metadata size against the remaining buffer size. (cherry picked from commit 4c5e7b27d57dd2be777780e840eef9be63242158) Signed-off-by: Anton Khirnov <[email protected]> --- libavcodec/flacdec.c | 4 +++- 1 files changed, 3 insertions(+), 1 deletions(-) diff --git a/libavcodec/flacdec.c b/libavcodec/flacdec.c index 1ce8559..7331c5c 100644 --- a/libavcodec/flacdec.c +++ b/libavcodec/flacdec.c @@ -228,9 +228,11 @@ static int get_metadata_size(const uint8_t *buf, int buf_size) buf += 4; do { + if (buf_end - buf < 4) + return 0; ff_flac_parse_block_header(buf, &metadata_last, NULL, &metadata_size); buf += 4; - if (buf + metadata_size > buf_end) { + if (buf_end - buf < metadata_size) { /* need more data in order to read the complete header */ return 0; } _______________________________________________ libav-commits mailing list [email protected] https://lists.libav.org/mailman/listinfo/libav-commits
