diff mbox series

[FFmpeg-devel,2/7] avformat/ac4dec: Check remaining space in ac4_probe()

Message ID 20240523011758.2434580-2-michael@niedermayer.cc
State Accepted
Commit 2f04cb673cb394b6e1cda160af8faa733b62bae2
Headers show
Series [FFmpeg-devel,1/7] avdevice/pulse_audio_enc: Use av_rescale() to avoid integer overflow | expand

Checks

Context Check Description
yinshiyou/make_loongarch64 success Make finished
yinshiyou/make_fate_loongarch64 success Make fate finished
andriy/make_x86 success Make finished
andriy/make_fate_x86 success Make fate finished

Commit Message

Michael Niedermayer May 23, 2024, 1:17 a.m. UTC 
Fixes: CID1538298 Untrusted loop bound
Fixes: undefined behavior

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/ac4dec.c | 2 ++
 1 file changed, 2 insertions(+)
diff mbox series

Patch

diff --git a/libavformat/ac4dec.c b/libavformat/ac4dec.c
index f647f557ccd..dc6638de3a4 100644
--- a/libavformat/ac4dec.c
+++ b/libavformat/ac4dec.c
@@ -43,6 +43,8 @@  static int ac4_probe(const AVProbeData *p)
             size += 4;
             if (buf[1] == 0x41)
                 size += 2;
+            if (left < size)
+                break;
             max_frames++;
             left -= size;
             buf += size;