Skip to content

Commit 96f24d1

Browse files
孙浩 and 张洪亮(望初)michaelni
孙浩 and 张洪亮(望初)
authored andcommitted
avformat/rl2: Fix DoS due to lack of eof check
Fixes: loop.rl2 Found-by: Xiaohei and Wangchu from Alibaba Security Team Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
1 parent 124eb20 commit 96f24d1

File tree

1 file changed

+12
-3
lines changed

1 file changed

+12
-3
lines changed

Diff for: libavformat/rl2.c

+12-3
Original file line numberDiff line numberDiff line change
@@ -170,12 +170,21 @@ static av_cold int rl2_read_header(AVFormatContext *s)
170170
}
171171

172172
/** read offset and size tables */
173-
for(i=0; i < frame_count;i++)
173+
for(i=0; i < frame_count;i++) {
174+
if (avio_feof(pb))
175+
return AVERROR_INVALIDDATA;
174176
chunk_size[i] = avio_rl32(pb);
175-
for(i=0; i < frame_count;i++)
177+
}
178+
for(i=0; i < frame_count;i++) {
179+
if (avio_feof(pb))
180+
return AVERROR_INVALIDDATA;
176181
chunk_offset[i] = avio_rl32(pb);
177-
for(i=0; i < frame_count;i++)
182+
}
183+
for(i=0; i < frame_count;i++) {
184+
if (avio_feof(pb))
185+
return AVERROR_INVALIDDATA;
178186
audio_size[i] = avio_rl32(pb) & 0xFFFF;
187+
}
179188

180189
/** build the sample index */
181190
for(i=0;i<frame_count;i++){

0 commit comments

Comments
 (0)