summaryrefslogtreecommitdiff
path: root/libavformat/wtvdec.c
diff options
context:
space:
mode:
authorMichael Niedermayer <michaelni@gmx.at>2012-04-14 18:32:36 +0200
committerMichael Niedermayer <michaelni@gmx.at>2012-04-14 18:54:10 +0200
commitc42efad3c34cace09555e05fd0cb81cb59cc726f (patch)
tree22c764606a8457b1c68e743f24f266d034fe9129 /libavformat/wtvdec.c
parent83c7803f55b3231faeb93c1a634399a70fae9480 (diff)
downloadffmpeg-c42efad3c34cace09555e05fd0cb81cb59cc726f.tar.gz
wtvdec: fix name_size check to consider integer overflows.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavformat/wtvdec.c')
-rw-r--r--libavformat/wtvdec.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/libavformat/wtvdec.c b/libavformat/wtvdec.c
index 537dc8ee0d..a2a26c2ccb 100644
--- a/libavformat/wtvdec.c
+++ b/libavformat/wtvdec.c
@@ -258,7 +258,7 @@ static AVIOContext * wtvfile_open2(AVFormatContext *s, const uint8_t *buf, int b
dir_length = AV_RL16(buf + 16);
file_length = AV_RL64(buf + 24);
name_size = 2 * AV_RL32(buf + 32);
- if (buf + 48 + name_size > buf_end) {
+ if (buf + 48 + (int64_t)name_size > buf_end || name_size<0) {
av_log(s, AV_LOG_ERROR, "filename exceeds buffer size; remaining directory entries ignored\n");
break;
}