Related to CVE-2011-3940.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
---
libavformat/nsvdec.c | 4 ++++
1 files changed, 4 insertions(+), 0 deletions(-)
diff --git a/libavformat/nsvdec.c b/libavformat/nsvdec.c
index 70b2536..7da6339 100644
--- a/libavformat/nsvdec.c
+++ b/libavformat/nsvdec.c
@@ -351,6 +351,8 @@ static int nsv_parse_NSVf_header(AVFormatContext *s,
AVFormatParameters *ap)
if((unsigned)table_entries_used >= UINT_MAX / sizeof(uint32_t))
return -1;
nsv->nsvs_file_offset = av_malloc((unsigned)table_entries_used *
sizeof(uint32_t));
+ if (!nsv->nsvs_file_offset)
+ return AVERROR(ENOMEM);
for(i=0;i<table_entries_used;i++)
nsv->nsvs_file_offset[i] = avio_rl32(pb) + size;
@@ -358,6 +360,8 @@ static int nsv_parse_NSVf_header(AVFormatContext *s,
AVFormatParameters *ap)
if(table_entries > table_entries_used &&
avio_rl32(pb) == MKTAG('T','O','C','2')) {
nsv->nsvs_timestamps =
av_malloc((unsigned)table_entries_used*sizeof(uint32_t));
+ if (!nsv->nsvs_timestamps)
+ return AVERROR(ENOMEM);
for(i=0;i<table_entries_used;i++) {
nsv->nsvs_timestamps[i] = avio_rl32(pb);
}
--
1.7.7.3
_______________________________________________
libav-devel mailing list
[email protected]
https://lists.libav.org/mailman/listinfo/libav-devel
