generic-library/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

avformat/mpegts: Fix potential pointer overflows

Browse Source 
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2015-03-16 22:37:46 +01:00
parent 29db8e45fc
commit 1b3b018aa4
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
libavformat/mpegts.c
View File

@ -596,7 +596,7 @@ static inline int get16(const uint8_t **pp, const uint8_t *p_end)
int c; int c;
p = *pp; p = *pp;
if ((p + 1) >= p_end) if (1 >= p_end - p)
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
c = AV_RB16(p); c = AV_RB16(p);
p += 2; p += 2;
@ -615,7 +615,7 @@ static char *getstr8(const uint8_t **pp, const uint8_t *p_end)
len = get8(&p, p_end); len = get8(&p, p_end);
if (len < 0) if (len < 0)
return NULL; return NULL;
if ((p + len) > p_end) if (len > p_end - p)
return NULL; return NULL;
str = av_malloc(len + 1); str = av_malloc(len + 1);
if (!str) if (!str)
@ -2181,7 +2181,7 @@ static int handle_packet(MpegTSContext *ts, const uint8_t *packet)
if (is_start) { if (is_start) {
/* pointer field present */ /* pointer field present */
len = *p++; len = *p++;
if (p + len > p_end) if (len > p_end - p)
return 0; return 0;
if (len && cc_ok) { if (len && cc_ok) {
/* write remaining section bytes */ /* write remaining section bytes */