Commit aa516993 authored by Michael Niedermayer's avatar Michael Niedermayer

avformat/rtpdec_xiph: Check upper bound on len in xiph_handle_packet()

Larger packets are not supported and would cause problems later
Signed-off-by: 's avatarMichael Niedermayer <michaelni@gmx.at>
parent 81198a68
...@@ -88,7 +88,7 @@ static int xiph_handle_packet(AVFormatContext *ctx, PayloadContext *data, ...@@ -88,7 +88,7 @@ static int xiph_handle_packet(AVFormatContext *ctx, PayloadContext *data,
return data->split_pkts > 0; return data->split_pkts > 0;
} }
if (len < 6) { if (len < 6 || len > INT_MAX/2) {
av_log(ctx, AV_LOG_ERROR, "Invalid %d byte packet\n", len); av_log(ctx, AV_LOG_ERROR, "Invalid %d byte packet\n", len);
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
} }
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment