[FFmpeg-devel] [PATCH] mp4toannexb modification / improvement

[Luca Abeni]

Hi Michael,

On 08/06/10 20:21, Michael Niedermayer wrote:
[...]
>>               codec->bit_rate = icodec->bit_rate;
>> -            codec->extradata= icodec->extradata;
>> +            codec->extradata= av_mallocz(icodec->extradata_size + FF_INPUT_BUFFER_PADDING_SIZE);
>> +            if (!codec->extradata)
>> +                goto fail;
>> +            memcpy(codec->extradata, icodec->extradata, icodec->extradata_size);
>
> while it is quite obscure but the + could overflow and lead to a
> successfull allocation of a too small buffer

Thanks for pointing this out... Would something like
     uint64_t extra_size = (uint64_t)icodec->extradata_size + 
FF_INPUT_BUFFER_PADDING_SIZE;
     if (extra_size > INT_MAX)
         goto fail;
be enough to fix the problem?

If yes, I'll commit the patch with this improvement.


			Thanks,
				Luca