Xi Wang c3744b415a rtmp: fix buffer overflows in ff_amf_tag_contents() ...

A negative `size' will bypass FFMIN().  In the subsequent memcpy() call,
`size' will be considered as a large positive value, leading to a buffer
overflow.

Change the type of `size' to unsigned int to avoid buffer overflow, and
simplify overflow checks accordingly.

Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 4e692374f7)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

2013-02-07 01:00:01 +01:00

16 KiB

Raw Blame History

View Raw