[FFmpeg-cvslog] apetag: Fix APE tag size check
Katerina Barone-Adesi
git at videolan.org
Fri Nov 14 19:28:34 CET 2014
ffmpeg | branch: release/2.0 | Katerina Barone-Adesi <katerinab at gmail.com> | Tue Sep 16 01:40:24 2014 +0200| [47fe68eec82106606e4b9fec20245fde33204315] | committer: Michael Niedermayer
apetag: Fix APE tag size check
The size variable is (correctly) unsigned, but is passed to several functions
which take signed parameters, such as avio_read, sometimes after having
numbers added to it. So ensure that size remains within the bounds that
these functions can handle.
CC: libav-stable at libav.org
Signed-off-by: Diego Biurrun <diego at biurrun.de>
(cherry picked from commit c5560e72d0bb69f8a1ac9536570398f84388f396)
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=47fe68eec82106606e4b9fec20245fde33204315
---
libavformat/apetag.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/libavformat/apetag.c b/libavformat/apetag.c
index ab93736..6b7c01e 100644
--- a/libavformat/apetag.c
+++ b/libavformat/apetag.c
@@ -53,8 +53,10 @@ static int ape_tag_read_field(AVFormatContext *s)
av_log(s, AV_LOG_WARNING, "Invalid APE tag key '%s'.\n", key);
return -1;
}
- if (size >= UINT_MAX)
- return -1;
+ if (size > INT32_MAX - FF_INPUT_BUFFER_PADDING_SIZE) {
+ av_log(s, AV_LOG_ERROR, "APE tag size too large.\n");
+ return AVERROR_INVALIDDATA;
+ }
if (flags & APE_TAG_FLAG_IS_BINARY) {
uint8_t filename[1024];
enum AVCodecID id;
More information about the ffmpeg-cvslog
mailing list