ffmpeg | branch: master | 李赞 <li...@ruc.edu.cn> | Wed May 10 14:55:34 2017 +0200| [3d232196372f309a75ed074c4cef30578eec1782] | committer: Michael Niedermayer
avformat/wavdec: Check chunk_size Fixes integer overflow and out of array access Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=3d232196372f309a75ed074c4cef30578eec1782 --- libavformat/wavdec.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavformat/wavdec.c b/libavformat/wavdec.c index 602ce97530..81dbc9f16e 100644 --- a/libavformat/wavdec.c +++ b/libavformat/wavdec.c @@ -841,6 +841,8 @@ static int w64_read_header(AVFormatContext *s) chunk_key[4] = 0; avio_read(pb, chunk_key, 4); chunk_size = avio_rl32(pb); + if (chunk_size == UINT32_MAX) + return AVERROR_INVALIDDATA; value = av_mallocz(chunk_size + 1); if (!value) _______________________________________________ ffmpeg-cvslog mailing list ffmpeg-cvslog@ffmpeg.org http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
