diff mbox

[FFmpeg-devel,3/3] avformat/oggparseogm: Check lb against psize

Message ID 20180309013754.24682-3-michael@niedermayer.cc
State Accepted
Commit 3e7c847aaf5a298b62afae12b4ecfb8e12385998
Headers show

Commit Message

Michael Niedermayer March 9, 2018, 1:37 a.m. UTC 
No testcase, this was found during code review

Found-by: Matt Wolenetz <wolenetz@google.com>

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/oggparseogm.c | 3 +++
 1 file changed, 3 insertions(+)

Comments

Michael Niedermayer March 10, 2018, 12:22 a.m. UTC | #1 
On Fri, Mar 09, 2018 at 02:37:54AM +0100, Michael Niedermayer wrote:
> No testcase, this was found during code review
> 
> Found-by: Matt Wolenetz <wolenetz@google.com>
> 
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavformat/oggparseogm.c | 3 +++
>  1 file changed, 3 insertions(+)

applied

[...]
diff mbox

Patch

diff --git a/libavformat/oggparseogm.c b/libavformat/oggparseogm.c
index 4b4edf26ca..a07453760b 100644
--- a/libavformat/oggparseogm.c
+++ b/libavformat/oggparseogm.c
@@ -176,6 +176,9 @@  ogm_packet(AVFormatContext *s, int idx)
         os->pflags |= AV_PKT_FLAG_KEY;
 
     lb = ((*p & 2) << 1) | ((*p >> 6) & 3);
+    if (os->psize < lb + 1)
+        return AVERROR_INVALIDDATA;
+
     os->pstart += lb + 1;
     os->psize -= lb + 1;