On 28/04/15 20:57, Andreas Cadhalpun wrote: > The existing check has two problems: > 1) i + count can overflow, so that the check '< 256' returns true. > 2) In the (i == 'N') case occurs a j-- so that the loop runs once more. > > This can trigger the assertion 'nut->header_len[0] == 0' or cause > segmentation faults or infinite hangs. > > Signed-off-by: Andreas Cadhalpun <[email protected]> > --- > libavformat/nutdec.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/libavformat/nutdec.c b/libavformat/nutdec.c > index 1bb2091..46946d3 100644 > --- a/libavformat/nutdec.c > +++ b/libavformat/nutdec.c > @@ -294,7 +294,7 @@ static int decode_main_header(NUTContext *nut) > while (tmp_fields-- > 8) > ffio_read_varlen(bc); > > - if (count == 0 || i + count > 256) { > + if (count <= 0 || (i > 'N' && count > 256 - i) || (i <= 'N' && count > > 255 - i)) { > av_log(s, AV_LOG_ERROR, "illegal count %d at %d\n", count, i); > return AVERROR_INVALIDDATA; > } >
Can you please send me a file triggering this if you have it? lu _______________________________________________ libav-devel mailing list [email protected] https://lists.libav.org/mailman/listinfo/libav-devel
