Commit a82e65f0 authored by Derek Buitenhuis's avatar Derek Buitenhuis Committed by Michael Niedermayer

avformat/webmdashenc: Validate the 'streams' adaptation sets parameter

It should not be a value larger than the number of streams we have,
or it will cause invalid reads and/or SIGSEGV.
Signed-off-by: 's avatarMichael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ec07efa7)
Signed-off-by: 's avatarMichael Niedermayer <michael@niedermayer.cc>
parent 6918b400
...@@ -245,7 +245,11 @@ static int parse_adaptation_sets(AVFormatContext *s) ...@@ -245,7 +245,11 @@ static int parse_adaptation_sets(AVFormatContext *s)
as->streams = av_realloc(as->streams, sizeof(*as->streams) * ++as->nb_streams); as->streams = av_realloc(as->streams, sizeof(*as->streams) * ++as->nb_streams);
if (as->streams == NULL) return -1; if (as->streams == NULL) return -1;
as->streams[as->nb_streams - 1] = to_integer(p, q - p + 1); as->streams[as->nb_streams - 1] = to_integer(p, q - p + 1);
if (as->streams[as->nb_streams - 1] < 0) return -1; if (as->streams[as->nb_streams - 1] < 0 ||
as->streams[as->nb_streams - 1] >= s->nb_streams) {
av_log(s, AV_LOG_ERROR, "Invalid value for 'streams' in adapation_sets.\n");
return AVERROR(EINVAL);
}
if (*q == '\0') break; if (*q == '\0') break;
if (*q == ' ') state = new_set; if (*q == ' ') state = new_set;
p = ++q; p = ++q;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment