Message ID | 20191227155835.13273-1-lance.lmwang@gmail.com |
---|---|
State | Accepted |
Commit | 93671d675597e685215a9ade4ddf7b00271f5767 |
Headers | show |
lgtm On 12/27/19, lance.lmwang@gmail.com <lance.lmwang@gmail.com> wrote: > From: Limin Wang <lance.lmwang@gmail.com> > > Signed-off-by: Limin Wang <lance.lmwang@gmail.com> > --- > libavcodec/mvha.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/libavcodec/mvha.c b/libavcodec/mvha.c > index c270063..afe5e51 100644 > --- a/libavcodec/mvha.c > +++ b/libavcodec/mvha.c > @@ -161,6 +161,9 @@ static int decode_frame(AVCodecContext *avctx, > type = AV_RB32(avpkt->data); > size = AV_RL32(avpkt->data + 4); > > + if (size < 1 || size >= avpkt->size) > + return AVERROR_INVALIDDATA; > + > if ((ret = ff_get_buffer(avctx, frame, 0)) < 0) > return ret; > > -- > 2.9.5 > > _______________________________________________ > ffmpeg-devel mailing list > ffmpeg-devel@ffmpeg.org > https://ffmpeg.org/mailman/listinfo/ffmpeg-devel > > To unsubscribe, visit link above, or email > ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
On 12/27/2019 1:00 PM, Paul B Mahol wrote: > lgtm Pushed. > > On 12/27/19, lance.lmwang@gmail.com <lance.lmwang@gmail.com> wrote: >> From: Limin Wang <lance.lmwang@gmail.com> >> >> Signed-off-by: Limin Wang <lance.lmwang@gmail.com> >> --- >> libavcodec/mvha.c | 3 +++ >> 1 file changed, 3 insertions(+) >> >> diff --git a/libavcodec/mvha.c b/libavcodec/mvha.c >> index c270063..afe5e51 100644 >> --- a/libavcodec/mvha.c >> +++ b/libavcodec/mvha.c >> @@ -161,6 +161,9 @@ static int decode_frame(AVCodecContext *avctx, >> type = AV_RB32(avpkt->data); >> size = AV_RL32(avpkt->data + 4); >> >> + if (size < 1 || size >= avpkt->size) >> + return AVERROR_INVALIDDATA; >> + >> if ((ret = ff_get_buffer(avctx, frame, 0)) < 0) >> return ret;
diff --git a/libavcodec/mvha.c b/libavcodec/mvha.c index c270063..afe5e51 100644 --- a/libavcodec/mvha.c +++ b/libavcodec/mvha.c @@ -161,6 +161,9 @@ static int decode_frame(AVCodecContext *avctx, type = AV_RB32(avpkt->data); size = AV_RL32(avpkt->data + 4); + if (size < 1 || size >= avpkt->size) + return AVERROR_INVALIDDATA; + if ((ret = ff_get_buffer(avctx, frame, 0)) < 0) return ret;