From 0a41a8bf2945e59db7a0773ebce11a26b95d45b6 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Thu, 27 Sep 2018 00:00:26 +0200
Subject: [PATCH] avformat/utils: Fix potential integer overflow in
extract_extradata()
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/utils.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/libavformat/utils.c b/libavformat/utils.c
index dcc0de92550..a8ac90213e0 100644
--- a/libavformat/utils.c
+++ b/libavformat/utils.c
@@ -3544,7 +3544,9 @@ static int extract_extradata(AVStream *st, AVPacket *pkt)
&extradata_size);
if (extradata) {
- sti->avctx->extradata = av_mallocz(extradata_size + AV_INPUT_BUFFER_PADDING_SIZE);
+ av_assert0(!sti->avctx->extradata);
+ if ((unsigned)extradata_size < FF_MAX_EXTRADATA_SIZE)
+ sti->avctx->extradata = av_mallocz(extradata_size + AV_INPUT_BUFFER_PADDING_SIZE);
if (!sti->avctx->extradata) {
av_packet_unref(pkt_ref);
return AVERROR(ENOMEM);
--
GitLab