ffmpeg | branch: release/0.10 | Katerina Barone-Adesi <kateri...@gmail.com> |
Tue Sep 16 01:40:24 2014 +0200| [b989bb7adee0f3286dcaa63c5cd0753eac45f6be] |
committer: Diego Biurrun
apetag: Fix APE tag size check
The size variable is (correctly) unsigned, but is passed to several functions
which take signed parameters, such as avio_read, sometimes after having
numbers added to it. So ensure that size remains within the bounds that
these functions can handle.
(cherry picked from commit 56ac2cbd0464e0146e62c91843e2b1f5e0908504)
Signed-off-by: Diego Biurrun <di...@biurrun.de>
Conflicts:
libavformat/apetag.c
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=b989bb7adee0f3286dcaa63c5cd0753eac45f6be
---
libavformat/apetag.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/libavformat/apetag.c b/libavformat/apetag.c
index 2390bfa..41ba054 100644
--- a/libavformat/apetag.c
+++ b/libavformat/apetag.c
@@ -51,8 +51,10 @@ static int ape_tag_read_field(AVFormatContext *s)
av_log(s, AV_LOG_WARNING, "Invalid APE tag key '%s'.\n", key);
return -1;
}
- if (size >= UINT_MAX)
- return -1;
+ if (size > INT32_MAX - FF_INPUT_BUFFER_PADDING_SIZE) {
+ av_log(s, AV_LOG_ERROR, "APE tag size too large.\n");
+ return AVERROR_INVALIDDATA;
+ }
value = av_malloc(size+1);
if (!value)
return AVERROR(ENOMEM);
_______________________________________________
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
