Skip to content

Commit 2b46ebd

Browse files
committed
avformat/asfdec_o: Check size_bmp more fully
Fixes: integer overflow and out of array access Fixes: asfo-crash-46080c4341572a7137a162331af77f6ded45cbd7 Found-by: Paul Ch <paulcher@icloud.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
1 parent bab0716 commit 2b46ebd

File tree

1 file changed

+2
-1
lines changed

1 file changed

+2
-1
lines changed

Diff for: libavformat/asfdec_o.c

+2-1
Original file line numberDiff line numberDiff line change
@@ -706,7 +706,8 @@ static int parse_video_info(AVIOContext *pb, AVStream *st)
706706
st->codecpar->codec_id = ff_codec_get_id(ff_codec_bmp_tags, tag);
707707
size_bmp = FFMAX(size_asf, size_bmp);
708708

709-
if (size_bmp > BMP_HEADER_SIZE) {
709+
if (size_bmp > BMP_HEADER_SIZE &&
710+
size_bmp < INT_MAX - AV_INPUT_BUFFER_PADDING_SIZE) {
710711
int ret;
711712
st->codecpar->extradata_size = size_bmp - BMP_HEADER_SIZE;
712713
if (!(st->codecpar->extradata = av_malloc(st->codecpar->extradata_size +

0 commit comments

Comments
 (0)