Commit 0b882b40 authored by Reimar Döffinger's avatar Reimar Döffinger
Browse files

Fix crash in MLP decoder due to integer overflow.

Probably only DoS, init_get_bits sets buffer to NULL, thus causing a
NULL-dereference directly after.

Originally committed as revision 21426 to svn://svn.ffmpeg.org/ffmpeg/trunk
parent 8ba43617
......@@ -959,7 +959,7 @@ static int read_access_unit(AVCodecContext *avctx, void* data, int *data_size,
length = (AV_RB16(buf) & 0xfff) * 2;
if (length > buf_size)
if (length < 4 || length > buf_size)
return -1;
init_get_bits(&gb, (buf + 4), (length - 4) * 8);
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment