projects
/
ffmpeg.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
| inline |
side by side
(parent:
1dac4d5
)
Do not attempt to decode APE file with no frames
author
Kostya
<kostya.shishkov@gmail.com>
Tue, 15 Mar 2011 09:19:43 +0000
(09:19 +0000)
committer
Reinhard Tartler
<siretart@tauware.de>
Wed, 16 Mar 2011 11:53:52 +0000
(12:53 +0100)
This fixes invalid reads/writes with this sample:
http://packetstorm.linuxsecurity.com/1103-exploits/vlc105-dos.txt
libavformat/ape.c
patch
|
blob
|
history
diff --git
a/libavformat/ape.c
b/libavformat/ape.c
index
6c26984
..
dd2aeb9
100644
(file)
--- a/
libavformat/ape.c
+++ b/
libavformat/ape.c
@@
-242,6
+242,10
@@
static int ape_read_header(AVFormatContext * s, AVFormatParameters * ap)
avio_seek(pb, ape->wavheaderlength, SEEK_CUR);
}
+ if(!ape->totalframes){
+ av_log(s, AV_LOG_ERROR, "No frames in the file!\n");
+ return AVERROR(EINVAL);
+ }
if(ape->totalframes > UINT_MAX / sizeof(APEFrame)){
av_log(s, AV_LOG_ERROR, "Too many frames: %d\n", ape->totalframes);
return -1;