From 41afac7f7a67c634c86b1d17fc930e9183d4aaa0 Mon Sep 17 00:00:00 2001
From: "Ronald S. Bultje" <rsbultje@gmail.com>
Date: Fri, 17 Feb 2012 12:21:18 -0800
Subject: [PATCH] asf: prevent packet_size_left from going negative if hdrlen >
pktlen.
This prevents failed assertions further down in the packet processing
where we require non-negative values for packet_size_left.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
---
libavformat/asfdec.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/libavformat/asfdec.c b/libavformat/asfdec.c
index bae0eacd107..2922ecf515b 100644
--- a/libavformat/asfdec.c
+++ b/libavformat/asfdec.c
@@ -789,6 +789,13 @@ static int ff_asf_get_packet(AVFormatContext *s, AVIOContext *pb)
asf->packet_segments = 1;
asf->packet_segsizetype = 0x80;
}
+ if (rsize > packet_length - padsize) {
+ asf->packet_size_left = 0;
+ av_log(s, AV_LOG_ERROR,
+ "invalid packet header length %d for pktlen %d-%d at %"PRId64"\n",
+ rsize, packet_length, padsize, avio_tell(pb));
+ return -1;
+ }
asf->packet_size_left = packet_length - padsize - rsize;
if (packet_length < asf->hdr.min_pktsize)
padsize += asf->hdr.min_pktsize - packet_length;
--
GitLab