Merge commit '24130234cd9dd733116d17b724ea4c8e12ce097a'
authorClément Bœsch <u@pkh.me>
Sun, 19 Mar 2017 17:22:53 +0000 (18:22 +0100)
committerClément Bœsch <u@pkh.me>
Sun, 19 Mar 2017 17:24:35 +0000 (18:24 +0100)
* commit '24130234cd9dd733116d17b724ea4c8e12ce097a':
  rtpdec_mpeg4: validate fmtp fields

Merged with fixed log message.

Merged-by: Clément Bœsch <u@pkh.me>
1  2 
libavformat/rtpdec_mpeg4.c

@@@ -289,11 -290,22 +289,22 @@@ static int parse_fmtp(AVFormatContext *
          for (i = 0; attr_names[i].str; ++i) {
              if (!av_strcasecmp(attr, attr_names[i].str)) {
                  if (attr_names[i].type == ATTR_NAME_TYPE_INT) {
 -                               "The %s field size is invalid (%d).",
+                     int val = atoi(value);
+                     if (val > 32) {
+                         av_log(s, AV_LOG_ERROR,
++                               "The %s field size is invalid (%d)\n",
+                                attr, val);
+                         return AVERROR_INVALIDDATA;
+                     }
                      *(int *)((char *)data+
-                         attr_names[i].offset) = atoi(value);
-                 } else if (attr_names[i].type == ATTR_NAME_TYPE_STR)
+                         attr_names[i].offset) = val;
+                 } else if (attr_names[i].type == ATTR_NAME_TYPE_STR) {
+                     char *val = av_strdup(value);
+                     if (!val)
+                         return AVERROR(ENOMEM);
                      *(char **)((char *)data+
-                         attr_names[i].offset) = av_strdup(value);
+                         attr_names[i].offset) = val;
+                 }
              }
          }
      }