A negative chunk size is illegal and would end up used as
length for memcpy, where it would lead to memory accesses
out of bounds.
Found-by: Paul Cher <paulcher@icloud.com>
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
av_log(NULL, AV_LOG_TRACE, "Chunked encoding data size: %"PRId64"'\n",
s->chunksize);
-
- if (!s->chunksize)
+ if (s->chunksize < 0)
+ return AVERROR_INVALIDDATA;
+ else if (!s->chunksize)
return 0;
break;
}