Mercurial > libavformat.hg
diff segafilm.c @ 639:0b52743104ac libavformat
integer overflows, heap corruption
possible arbitrary code execution cannot be ruled out in some cases
precautionary checks
author | michael |
---|---|
date | Sat, 08 Jan 2005 14:21:33 +0000 |
parents | 0fdc96c2f2fe |
children | 253b5292946a |
line wrap: on
line diff
--- a/segafilm.c Thu Jan 06 00:54:03 2005 +0000 +++ b/segafilm.c Sat Jan 08 14:21:33 2005 +0000 @@ -171,6 +171,8 @@ return AVERROR_INVALIDDATA; film->base_clock = BE_32(&scratch[8]); film->sample_count = BE_32(&scratch[12]); + if(film->sample_count >= UINT_MAX / sizeof(film_sample_t)) + return -1; film->sample_table = av_malloc(film->sample_count * sizeof(film_sample_t)); for(i=0; i<s->nb_streams; i++)