avcodec/av1_parse: Check obu_size
Fixes: out of array read Fixes: SIGSEGV_get_obu_bit_length_av1_parse Found-by: keval shah <skeval65@gmail.com> Reviewed-by: James Almer <jamrial@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
@@ -134,8 +134,8 @@ static inline int parse_obu_header(const uint8_t *buf, int buf_size,
|
|||||||
|
|
||||||
size = *obu_size + *start_pos;
|
size = *obu_size + *start_pos;
|
||||||
|
|
||||||
if (size > INT_MAX)
|
if (size > buf_size)
|
||||||
return AVERROR(ERANGE);
|
return AVERROR_INVALIDDATA;
|
||||||
|
|
||||||
return size;
|
return size;
|
||||||
}
|
}
|
||||||
|
|||||||
Reference in New Issue
Block a user