diff options
author | Michael Niedermayer <michaelni@gmx.at> | 2015-05-12 18:03:55 +0200 |
---|---|---|
committer | Michael Niedermayer <michaelni@gmx.at> | 2015-05-12 18:03:55 +0200 |
commit | aa5169935e160551fb1c290d1397da2f04325817 (patch) | |
tree | a8734b3b5580bddc6211c3f7e5d11c8d8b3071b8 /libavformat/rtpdec_xiph.c | |
parent | 81198a68370e88f7d02f16de58db36713c2a50b6 (diff) | |
download | ffmpeg-aa5169935e160551fb1c290d1397da2f04325817.tar.gz |
avformat/rtpdec_xiph: Check upper bound on len in xiph_handle_packet()
Larger packets are not supported and would cause problems later
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavformat/rtpdec_xiph.c')
-rw-r--r-- | libavformat/rtpdec_xiph.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavformat/rtpdec_xiph.c b/libavformat/rtpdec_xiph.c index a09653f340..8492865b4f 100644 --- a/libavformat/rtpdec_xiph.c +++ b/libavformat/rtpdec_xiph.c @@ -88,7 +88,7 @@ static int xiph_handle_packet(AVFormatContext *ctx, PayloadContext *data, return data->split_pkts > 0; } - if (len < 6) { + if (len < 6 || len > INT_MAX/2) { av_log(ctx, AV_LOG_ERROR, "Invalid %d byte packet\n", len); return AVERROR_INVALIDDATA; } |