highperfocused/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

avformat/matroskaenc: Check ff_vorbiscomment_length in put_flac_codecpriv()

Browse Source 
Its currently guaranteed to be smaller but its safer to check anyway

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 66f26b3e8ec075298e7ba329a55893d085bafe96)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2015-05-11 15:37:38 +02:00
parent a9d3baff03
commit 889a4779eb
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
libavformat/matroskaenc.c
View File

@ -545,12 +545,15 @@ static int put_flac_codecpriv(AVFormatContext *s,
"Lavf" : LIBAVFORMAT_IDENT; "Lavf" : LIBAVFORMAT_IDENT;
AVDictionary *dict = NULL; AVDictionary *dict = NULL;
uint8_t buf[32], *data, *p; uint8_t buf[32], *data, *p;
int len; int64_t len;
snprintf(buf, sizeof(buf), "0x%"PRIx64, codec->channel_layout); snprintf(buf, sizeof(buf), "0x%"PRIx64, codec->channel_layout);
av_dict_set(&dict, "WAVEFORMATEXTENSIBLE_CHANNEL_MASK", buf, 0); av_dict_set(&dict, "WAVEFORMATEXTENSIBLE_CHANNEL_MASK", buf, 0);
len = ff_vorbiscomment_length(dict, vendor); len = ff_vorbiscomment_length(dict, vendor);
if (len >= ((1<<24) - 4))
return AVERROR(EINVAL);
data = av_malloc(len + 4); data = av_malloc(len + 4);
if (!data) { if (!data) {
av_dict_free(&dict); av_dict_free(&dict);