diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2007-01-22 16:37:45 +0000 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2007-01-22 16:37:45 +0000 |
| commit | 4c71d7270104ce148faa2e44237450a9d303de96 (patch) | |
| tree | bf1e4546fc042513014aa09ab9a444136eea6068 | |
| parent | ae60a8578080a934592503a07dd1aa31b427f6e7 (diff) | |
| download | ffmpeg-4c71d7270104ce148faa2e44237450a9d303de96.tar.gz | |
check fragment offset and size
yes this too could have been exploitable ...
Originally committed as revision 7650 to svn://svn.ffmpeg.org/ffmpeg/trunk
| -rw-r--r-- | libavformat/asf.c | 8 | ||||
| -rw-r--r-- | libavformat/asf.h | 4 |
2 files changed, 10 insertions, 2 deletions
diff --git a/libavformat/asf.c b/libavformat/asf.c index fc3a7dead8..ef7ae5e6ea 100644 --- a/libavformat/asf.c +++ b/libavformat/asf.c @@ -703,6 +703,14 @@ static int asf_read_packet(AVFormatContext *s, AVPacket *pkt) asf->packet_size_left -= asf->packet_frag_size; if (asf->packet_size_left < 0) continue; + + if( asf->packet_frag_offset >= asf_st->pkt.size + || asf->packet_frag_size > asf_st->pkt.size - asf->packet_frag_offset){ + av_log(s, AV_LOG_ERROR, "packet fragment position invalid %u,%u not in %u\n", + asf->packet_frag_offset, asf->packet_frag_size, asf_st->pkt.size); + continue; + } + get_buffer(pb, asf_st->pkt.data + asf->packet_frag_offset, asf->packet_frag_size); asf_st->frag_offset += asf->packet_frag_size; diff --git a/libavformat/asf.h b/libavformat/asf.h index 0aabe793a7..457f92d199 100644 --- a/libavformat/asf.h +++ b/libavformat/asf.h @@ -106,8 +106,8 @@ typedef struct { int packet_replic_size; int packet_key_frame; int packet_padsize; - int packet_frag_offset; - int packet_frag_size; + unsigned int packet_frag_offset; + unsigned int packet_frag_size; int packet_frag_timestamp; int packet_multi_size; int packet_obj_size; |