Mercurial > libavformat.hg

changeset 4305:3e1bf36d7c73 libavformat

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Fix remotely exploitable arbitrary code execution vulnerability. Found by Tobias Klein / tk // trapkit / de / See: http://www.trapkit.de/advisories/TKADV2009-004.txt
author michael
date Wed, 28 Jan 2009 13:37:26 +0000
parents 8880764c2012
children 346301dcdd18
files 4xm.c
diffstat 1 files changed, 5 insertions(+), 4 deletions(-) [+]
line wrap: on
line diff
--- a/4xm.c	Tue Jan 27 23:44:11 2009 +0000
+++ b/4xm.c	Wed Jan 28 13:37:26 2009 +0000
@@ -166,12 +166,13 @@
                 goto fail;
             }
             current_track = AV_RL32(&header[i + 8]);
+            if((unsigned)current_track >= UINT_MAX / sizeof(AudioTrack) - 1){
+                av_log(s, AV_LOG_ERROR, "current_track too large\n");
+                ret= -1;
+                goto fail;
+            }
             if (current_track + 1 > fourxm->track_count) {
                 fourxm->track_count = current_track + 1;
-                if((unsigned)fourxm->track_count >= UINT_MAX / sizeof(AudioTrack)){
-                    ret= -1;
-                    goto fail;
-                }
                 fourxm->tracks = av_realloc(fourxm->tracks,
                     fourxm->track_count * sizeof(AudioTrack));
                 if (!fourxm->tracks) {