Module: libav Branch: release/0.8 Commit: 7981b5c20e614e792967f17d09cf1adfb07ae254
Author: Martin Storsjö <[email protected]> Committer: Luca Barbato <[email protected]> Date: Wed Sep 11 14:54:05 2013 +0300 omadec: Properly check lengths before incrementing the position Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: [email protected] Signed-off-by: Martin Storsjö <[email protected]> (cherry picked from commit 342c43d154e586bc022c86b168fe8d36f69da9d3) Signed-off-by: Luca Barbato <[email protected]> (cherry picked from commit 9eba02d5dd7036294ea350cb772822deec95b867) --- libavformat/omadec.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/libavformat/omadec.c b/libavformat/omadec.c index 9e8b43b..98ba1c5 100644 --- a/libavformat/omadec.c +++ b/libavformat/omadec.c @@ -170,7 +170,11 @@ static int nprobe(AVFormatContext *s, uint8_t *enc_header, unsigned size, taglen = AV_RB32(&enc_header[pos+32]); datalen = AV_RB32(&enc_header[pos+36]) >> 4; - pos += 44 + taglen; + pos += 44; + if (size - pos < taglen) + return -1; + + pos += taglen; if (datalen << 4 > size - pos) return -1; _______________________________________________ libav-commits mailing list [email protected] https://lists.libav.org/mailman/listinfo/libav-commits
