ffmpeg | branch: master | Michael Niedermayer <mich...@niedermayer.cc> | Thu Feb 11 22:12:36 2016 +0100| [bbc4d069d0ef70102a2e7e7b1c0d3a00f488e666] | committer: Michael Niedermayer
avcodec/cfhd: Check the number of tag/value pairs Fixes potentially long loop Fixes: CID1351382/11 Reviewed-by: Kieran Kunhya <kie...@kunhya.com> Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=bbc4d069d0ef70102a2e7e7b1c0d3a00f488e666 --- libavcodec/cfhd.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libavcodec/cfhd.c b/libavcodec/cfhd.c index 2436aae..5ecfcef 100644 --- a/libavcodec/cfhd.c +++ b/libavcodec/cfhd.c @@ -344,6 +344,11 @@ static int cfhd_decode(AVCodecContext *avctx, void *data, int *got_frame, break; } else if (tag == 2) { av_log(avctx, AV_LOG_DEBUG, "tag=2 header - skipping %i tag/value pairs\n", data); + if (data > bytestream2_get_bytes_left(&gb) / 4) { + av_log(avctx, AV_LOG_ERROR, "too many tag/value pairs (%d)\n", data); + ret = AVERROR_INVALIDDATA; + break; + } for (i = 0; i < data; i++) { uint16_t tag2 = bytestream2_get_be16(&gb); uint16_t val2 = bytestream2_get_be16(&gb); _______________________________________________ ffmpeg-cvslog mailing list ffmpeg-cvslog@ffmpeg.org http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
