generic-library/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

sierravmd: limit packetsize to the amount that could be read.

Browse Source 
Fixes huge allocations.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer
2011-12-24 22:06:25 +01:00
parent 2278ecc434
commit 47c4713a23
1 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
libavformat/sierravmd.c
View File

@@ -30,6 +30,7 @@
#include "libavutil/intreadwrite.h" #include "libavutil/intreadwrite.h"
#include "avformat.h" #include "avformat.h"
#include "internal.h" #include "internal.h"
#include "avio_internal.h"
#define VMD_HEADER_SIZE 0x0330 #define VMD_HEADER_SIZE 0x0330
#define BYTES_PER_FRAME_RECORD 16 #define BYTES_PER_FRAME_RECORD 16
@@ -246,6 +247,8 @@ static int vmd_read_packet(AVFormatContext *s,
/* position the stream (will probably be there already) */ /* position the stream (will probably be there already) */
avio_seek(pb, frame->frame_offset, SEEK_SET); avio_seek(pb, frame->frame_offset, SEEK_SET);
if(ffio_limit(pb, frame->frame_size) != frame->frame_size)
return AVERROR(EIO);
if (av_new_packet(pkt, frame->frame_size + BYTES_PER_FRAME_RECORD)) if (av_new_packet(pkt, frame->frame_size + BYTES_PER_FRAME_RECORD))
return AVERROR(ENOMEM); return AVERROR(ENOMEM);
pkt->pos= avio_tell(pb); pkt->pos= avio_tell(pb);