Commit fb1ea777 authored by Michael Niedermayer's avatar Michael Niedermayer

electronicarts: check size before reading duration out of a chunk.

Fixes null pointer dereference

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: 's avatarMichael Niedermayer <michaelni@gmx.at>
parent 461ecea0
......@@ -545,9 +545,11 @@ static int ea_read_packet(AVFormatContext *s,
case AV_CODEC_ID_ADPCM_EA_R1:
case AV_CODEC_ID_ADPCM_EA_R2:
case AV_CODEC_ID_ADPCM_IMA_EA_EACS:
if (pkt->size >= 4)
pkt->duration = AV_RL32(pkt->data);
break;
case AV_CODEC_ID_ADPCM_EA_R3:
if (pkt->size >= 4)
pkt->duration = AV_RB32(pkt->data);
break;
case AV_CODEC_ID_ADPCM_IMA_EA_SEAD:
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment