From 5d44c061cf511d97be5fac8d76be2f3915c6e798 Mon Sep 17 00:00:00 2001
From: Laurent Aimar <fenrir@videolan.org>
Date: Sat, 1 Oct 2011 00:44:55 +0200
Subject: [PATCH] Check for out of bound writes in the avs demuxer.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
---
libavformat/avs.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/libavformat/avs.c b/libavformat/avs.c
index 7b90f851530..ad5ac05988d 100644
--- a/libavformat/avs.c
+++ b/libavformat/avs.c
@@ -169,6 +169,8 @@ static int avs_read_packet(AVFormatContext * s, AVPacket * pkt)
switch (type) {
case AVS_PALETTE:
+ if (size - 4 > sizeof(palette))
+ return AVERROR_INVALIDDATA;
ret = avio_read(s->pb, palette, size - 4);
if (ret < size - 4)
return AVERROR(EIO);
--
GitLab