avformat/bit: check that pkt->size is 10 in write_packet
authorAndreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Thu, 26 Feb 2015 20:38:50 +0000 (21:38 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Thu, 26 Feb 2015 22:19:31 +0000 (23:19 +0100)
Ohter packet sizes are not supported by this muxer.

This avoids a null pointer dereference of pkt->data.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavformat/bit.c

index 7b807b9..5d05da0 100644 (file)
@@ -133,6 +133,9 @@ static int write_packet(AVFormatContext *s, AVPacket *pkt)
     GetBitContext gb;
     int i;
 
+    if (pkt->size != 10)
+        return AVERROR(EINVAL);
+
     avio_wl16(pb, SYNC_WORD);
     avio_wl16(pb, 8 * 10);