Skip to content
Permalink
Browse files Browse the repository at this point in the history
avformat/flvenc: Check audio packet size
Fixes: Assertion failure
Fixes: assert_flvenc.c:941_1.swf

Found-by: #CHEN HONGXU# <HCHEN017@e.ntu.edu.sg>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
  • Loading branch information
michaelni committed Aug 4, 2018
1 parent 476fd6b commit 6b67d7f
Showing 1 changed file with 5 additions and 0 deletions.
5 changes: 5 additions & 0 deletions libavformat/flvenc.c
Expand Up @@ -883,6 +883,11 @@ static int flv_write_packet(AVFormatContext *s, AVPacket *pkt)
int flags = -1, flags_size, ret;
int64_t cur_offset = avio_tell(pb);

if (par->codec_type == AVMEDIA_TYPE_AUDIO && !pkt->size) {
av_log(s, AV_LOG_WARNING, "Empty audio Packet\n");
return AVERROR(EINVAL);
}

if (par->codec_id == AV_CODEC_ID_VP6F || par->codec_id == AV_CODEC_ID_VP6A ||
par->codec_id == AV_CODEC_ID_VP6 || par->codec_id == AV_CODEC_ID_AAC)
flags_size = 2;
Expand Down

1 comment on commit 6b67d7f

@hongxuchen
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This got CVE-2018-15822.

Please sign in to comment.