提交 2aec600a 编写于 作者: A Andreas Cadhalpun 提交者: Anton Khirnov

asfdec: reject size > INT64_MAX in asf_read_unknown

Both avio_skip and detect_unknown_subobject use int64_t for the size
parameter.

This fixes a segmentation fault due to infinite recursion.
Signed-off-by: NAndreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: NAlexandra Hájková <alexandra.khirnova@gmail.com>
Signed-off-by: NAnton Khirnov <anton@khirnov.net>
上级 c69461d7
......@@ -178,6 +178,9 @@ static int asf_read_unknown(AVFormatContext *s, const GUIDParseTable *g)
uint64_t size = avio_rl64(pb);
int ret;
if (size > INT64_MAX)
return AVERROR_INVALIDDATA;
if (asf->is_header)
asf->unknown_size = size;
asf->is_header = 0;
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册