[FFmpeg-cvslog] siff: Fix excessive memory allocation.

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michaelni at gmx.at> | Sun Dec 18 22:43:19 2011 +0100| [1c73391d7d5e09977bc2c04b247647f69063cf19] | committer: Michael Niedermayer

siff: Fix excessive memory allocation.
Bug found by: Oana Stratulat

Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=1c73391d7d5e09977bc2c04b247647f69063cf19
---

 libavformat/siff.c |    5 +++++
 1 files changed, 5 insertions(+), 0 deletions(-)

diff --git a/libavformat/siff.c b/libavformat/siff.c
index a8d63ee..51dc694 100644
--- a/libavformat/siff.c
+++ b/libavformat/siff.c
@@ -201,7 +201,12 @@ static int siff_read_packet(AVFormatContext *s, AVPacket *pkt)
         }
 
         if (!c->curstrm){
+            int64_t fsize= avio_size(s->pb);
             size = c->pktsize - c->sndsize;
+            if(fsize>0)
+                size= FFMIN(size, fsize - avio_tell(s->pb) + c->gmcsize + 3);
+            if(size < 2 + c->gmcsize || c->pktsize < c->sndsize)
+                return AVERROR_INVALIDDATA;
             if (av_new_packet(pkt, size) < 0)
                 return AVERROR(ENOMEM);
             AV_WL16(pkt->data, c->flags);