highperfocused/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

omadec: fix len check in nprobe() prevent out of array access

Browse Source 
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2012-11-11 18:16:24 +01:00
parent 44c23aa1b8
commit f1d6f013b2
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
libavformat/omadec.c
View File

@ -159,7 +159,7 @@ static int nprobe(AVFormatContext *s, uint8_t *enc_header, int size, const uint8
taglen = AV_RB32(&enc_header[pos+32]); taglen = AV_RB32(&enc_header[pos+32]);
datalen = AV_RB32(&enc_header[pos+36]) >> 4; datalen = AV_RB32(&enc_header[pos+36]) >> 4;
if(taglen + (((uint64_t)datalen)<<4) + 44 > size) if(pos + (uint64_t)taglen + (((uint64_t)datalen)<<4) + 44 > size)
return -1; return -1;
pos += 44 + taglen; pos += 44 + taglen;