avformat/avidec: Limit formats in gab2 to srt and ass/ssa
authorMichael Niedermayer <michael@niedermayer.cc>
Tue, 30 May 2017 19:29:20 +0000 (21:29 +0200)
committerMichael Niedermayer <michael@niedermayer.cc>
Wed, 31 May 2017 00:45:14 +0000 (02:45 +0200)
This prevents part of one exploit leading to an information leak

Found-by: Emil Lerner and Pavel Cheremushkin
Reported-by: Thierry Foucu <tfoucu@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a5d849b149ca67ced2d271dc84db0bc95a548abb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
libavformat/avidec.c

index 955b27b..1a9563a 100644 (file)
@@ -1085,6 +1085,9 @@ static int read_gab2_sub(AVFormatContext *s, AVStream *st, AVPacket *pkt)
         if (!sub_demuxer)
             goto error;
 
+        if (strcmp(sub_demuxer->name, "srt") && strcmp(sub_demuxer->name, "ass"))
+            goto error;
+
         if (!(ast->sub_ctx = avformat_alloc_context()))
             goto error;