Merge commit '279e3aaa14daba6b7a37d75f3fb6e29c732d123f'
authorJames Almer <jamrial@gmail.com>
Sat, 28 Oct 2017 18:29:23 +0000 (15:29 -0300)
committerJames Almer <jamrial@gmail.com>
Sat, 28 Oct 2017 18:29:23 +0000 (15:29 -0300)
* commit '279e3aaa14daba6b7a37d75f3fb6e29c732d123f':
  flv: Validate the packet size

Merged-by: James Almer <jamrial@gmail.com>
1  2 
libavformat/flvdec.c

@@@ -1148,11 -909,16 +1148,17 @@@ retry_duration
      }
  
      if (st->codecpar->codec_id == AV_CODEC_ID_AAC ||
 -        st->codecpar->codec_id == AV_CODEC_ID_H264) {
 +        st->codecpar->codec_id == AV_CODEC_ID_H264 ||
 +        st->codecpar->codec_id == AV_CODEC_ID_MPEG4) {
          int type = avio_r8(s->pb);
          size--;
 -        if (st->codecpar->codec_id == AV_CODEC_ID_H264) {
+         if (size < 0) {
+             ret = AVERROR_INVALIDDATA;
+             goto leave;
+         }
 +        if (st->codecpar->codec_id == AV_CODEC_ID_H264 || st->codecpar->codec_id == AV_CODEC_ID_MPEG4) {
              // sign extension
              int32_t cts = (avio_rb24(s->pb) + 0xff800000) ^ 0xff800000;
              pts = dts + cts;