avformat/aviobuf: Check that avio_seek() target is non negative
authorMichael Niedermayer <michaelni@gmx.at>
Sun, 14 Dec 2014 16:26:11 +0000 (17:26 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Thu, 12 Mar 2015 17:03:49 +0000 (18:03 +0100)
Fixes out of array access

Suggested-by: Andrew Scherkus <scherkus@google.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit ed86dbd05d61363dc1c0d33f3267e2177c985fdd)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavformat/aviobuf.c

index d807478..3a360a0 100644 (file)
@@ -229,6 +229,9 @@ int64_t avio_seek(AVIOContext *s, int64_t offset, int whence)
             return offset1;
         offset += offset1;
     }
+    if (offset < 0)
+        return AVERROR(EINVAL);
+
     offset1 = offset - pos;
     if (!s->must_flush &&
         offset1 >= 0 && offset1 <= (s->buf_end - s->buffer)) {