diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-11-22 16:37:50 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-11-22 17:02:00 +0100 |
| commit | ba992711f79ccfba4ff0b305215d7056faf0ed0d (patch) | |
| tree | afd06987a6b7805afe090a72a6e36b166a46fbac /libavcodec/hnm4video.c | |
| parent | 7865759409b27089b444bc029b2b76b06161b2cf (diff) | |
| download | ffmpeg-ba992711f79ccfba4ff0b305215d7056faf0ed0d.tar.gz | |
avcodec/hnm4video: check that packetsize is at least 8
Fixes integer overflow and assertion failure
Fixes: signal_sigabrt_7ffff7126425_1243_CASSE.HNM
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/hnm4video.c')
| -rw-r--r-- | libavcodec/hnm4video.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/libavcodec/hnm4video.c b/libavcodec/hnm4video.c index 1e3c0fdecb..d2c4ce3a4c 100644 --- a/libavcodec/hnm4video.c +++ b/libavcodec/hnm4video.c @@ -359,6 +359,11 @@ static int hnm_decode_frame(AVCodecContext *avctx, void *data, int ret; uint16_t chunk_id; + if (avpkt->size < 8) { + av_log(avctx, AV_LOG_ERROR, "packet too small\n"); + return AVERROR_INVALIDDATA; + } + if ((ret = ff_get_buffer(avctx, frame, 0)) < 0) return ret; |