[FFmpeg-cvslog] avformat/aviobuf: Check that avio_seek() target is non negative
Michael Niedermayer
git at videolan.org
Sat Dec 20 02:47:11 CET 2014
ffmpeg | branch: release/2.4 | Michael Niedermayer <michaelni at gmx.at> | Sun Dec 14 17:26:11 2014 +0100| [0d277be45ae9bfbf4fb51408c3f3ef5b42296d66] | committer: Michael Niedermayer
avformat/aviobuf: Check that avio_seek() target is non negative
Fixes out of array access
Suggested-by: Andrew Scherkus <scherkus at google.com>
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>
(cherry picked from commit ed86dbd05d61363dc1c0d33f3267e2177c985fdd)
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=0d277be45ae9bfbf4fb51408c3f3ef5b42296d66
---
libavformat/aviobuf.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/libavformat/aviobuf.c b/libavformat/aviobuf.c
index b1752cd..d39b0c1 100644
--- a/libavformat/aviobuf.c
+++ b/libavformat/aviobuf.c
@@ -221,6 +221,9 @@ int64_t avio_seek(AVIOContext *s, int64_t offset, int whence)
return offset1;
offset += offset1;
}
+ if (offset < 0)
+ return AVERROR(EINVAL);
+
offset1 = offset - pos;
if (!s->must_flush && (!s->direct || !s->seek) &&
offset1 >= 0 && offset1 <= buffer_size) {
More information about the ffmpeg-cvslog
mailing list