eessppeelllloo/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2026-06-16 04:32:47 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix crash in MLP decoder due to integer overflow.

Browse Source 
Probably only DoS, init_get_bits sets buffer to NULL, thus causing a
NULL-dereference directly after.

backport r21426 by reimar


Originally committed as revision 21759 to svn://svn.ffmpeg.org/ffmpeg/branches/0.5
This commit is contained in:
Reinhard Tartler
2010-02-11 21:03:30 +00:00
parent 48b98cdc67
commit 9593c80062
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libavcodec/mlpdec.c
+1 -1
View File
@@ -878,7 +878,7 @@ static int read_access_unit(AVCodecContext *avctx, void* data, int *data_size,
length = (AV_RB16(buf) & 0xfff) * 2;
if (length > buf_size)
if (length < 4 || length > buf_size)
return -1;
init_get_bits(&gb, (buf + 4), (length - 4) * 8);