Commit 279e3aaa authored by Luca Barbato's avatar Luca Barbato

flv: Validate the packet size

Size can be negative at that point.

Bug-Id: 1041
CC: libav-stable@libav.org
parent 48097815
......@@ -912,6 +912,12 @@ skip:
st->codecpar->codec_id == AV_CODEC_ID_H264) {
int type = avio_r8(s->pb);
size--;
if (size < 0) {
ret = AVERROR_INVALIDDATA;
goto leave;
}
if (st->codecpar->codec_id == AV_CODEC_ID_H264) {
// sign extension
int32_t cts = (avio_rb24(s->pb) + 0xff800000) ^ 0xff800000;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment