Mercurial > libavcodec.hg
diff 4xm.c @ 3303:68721b62a528 libavcodec
sanity checks, some might have been exploitable ...
author | michael |
---|---|
date | Sat, 13 May 2006 10:45:26 +0000 |
parents | 072dbc669253 |
children | 1843a85123b7 |
line wrap: on
line diff
--- a/4xm.c Thu May 11 23:17:23 2006 +0000 +++ b/4xm.c Sat May 13 10:45:26 2006 +0000 @@ -606,7 +606,7 @@ int i, frame_4cc, frame_size; frame_4cc= get32(buf); - if(buf_size != get32(buf+4)+8){ + if(buf_size != get32(buf+4)+8 || buf_size < 20){ av_log(f->avctx, AV_LOG_ERROR, "size mismatch %d %d\n", buf_size, get32(buf+4)); } @@ -634,6 +634,10 @@ cfrm= &f->cfrm[i]; cfrm->data= av_fast_realloc(cfrm->data, &cfrm->allocated_size, cfrm->size + data_size + FF_INPUT_BUFFER_PADDING_SIZE); + if(!cfrm->data){ //explicit check needed as memcpy below might not catch a NULL + av_log(f->avctx, AV_LOG_ERROR, "realloc falure"); + return -1; + } memcpy(cfrm->data + cfrm->size, buf+20, data_size); cfrm->size += data_size;