OSDN Git Service
(root)
/
coroid
/
libav_saccubus.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
| inline |
side by side
(parent:
1c4bf2e
)
check entries against field_size, potential malloc overflow in read_stsz, fix #1357
author
Baptiste Coudurier
<baptiste.coudurier@gmail.com>
Mon, 7 Sep 2009 22:42:51 +0000
(22:42 +0000)
committer
Baptiste Coudurier
<baptiste.coudurier@gmail.com>
Mon, 7 Sep 2009 22:42:51 +0000
(22:42 +0000)
Originally committed as revision 19793 to svn://svn.ffmpeg.org/ffmpeg/trunk
libavformat/mov.c
patch
|
blob
|
history
diff --git
a/libavformat/mov.c
b/libavformat/mov.c
index
5f11ebe
..
05fdfa3
100644
(file)
--- a/
libavformat/mov.c
+++ b/
libavformat/mov.c
@@
-1256,7
+1256,7
@@
static int mov_read_stsz(MOVContext *c, ByteIOContext *pb, MOVAtom atom)
return -1;
}
- if
(entries >= UINT_MAX / sizeof(int)
)
+ if
(entries >= UINT_MAX / sizeof(int) || entries >= (UINT_MAX - 4) / field_size
)
return -1;
sc->sample_sizes = av_malloc(entries * sizeof(int));
if (!sc->sample_sizes)