Commit 523c8e05 authored by Michael Niedermayer's avatar Michael Niedermayer

Merge commit '50c449ac'

* commit '50c449ac':
  iff: validate CMAP palette size
  asfenc: return error on negative timestamp

Conflicts:
	libavformat/iff.c
Merged-by: 's avatarMichael Niedermayer <michaelni@gmx.at>
parents 6abb554f 50c449ac
......@@ -804,6 +804,14 @@ static int asf_write_packet(AVFormatContext *s, AVPacket *pkt)
flags &= ~AV_PKT_FLAG_KEY;
pts = (pkt->pts != AV_NOPTS_VALUE) ? pkt->pts : pkt->dts;
if (pts < 0) {
av_log(s, AV_LOG_ERROR,
"Negative dts not supported stream %d, dts %"PRId64"\n",
pkt->stream_index, pts);
return AVERROR(ENOSYS);
}
assert(pts != AV_NOPTS_VALUE);
pts *= 10000;
asf->duration = FFMAX(asf->duration, pts + pkt->duration * 10000);
......
......@@ -250,8 +250,11 @@ static int iff_read_header(AVFormatContext *s)
break;
case ID_CMAP:
if (data_size > INT_MAX - IFF_EXTRA_VIDEO_SIZE - FF_INPUT_BUFFER_PADDING_SIZE)
return AVERROR_INVALIDDATA;
if (data_size < 3 || data_size > 768 || data_size % 3) {
av_log(s, AV_LOG_ERROR, "Invalid CMAP chunk size %d\n",
data_size);
return AVERROR_INVALIDDATA;
}
st->codec->extradata_size = data_size + IFF_EXTRA_VIDEO_SIZE;
st->codec->extradata = av_malloc(data_size + IFF_EXTRA_VIDEO_SIZE + FF_INPUT_BUFFER_PADDING_SIZE);
if (!st->codec->extradata)
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment