Commit 953c6259 authored by 孙浩 and 张洪亮(望初)'s avatar 孙浩 and 张洪亮(望初) Committed by Michael Niedermayer

avformat/rl2: Fix DoS due to lack of eof check

Fixes: loop.rl2

Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: 's avatarMichael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 96f24d1b)
Signed-off-by: 's avatarMichael Niedermayer <michael@niedermayer.cc>
parent 770482de
......@@ -170,12 +170,21 @@ static av_cold int rl2_read_header(AVFormatContext *s)
}
/** read offset and size tables */
for(i=0; i < frame_count;i++)
for(i=0; i < frame_count;i++) {
if (avio_feof(pb))
return AVERROR_INVALIDDATA;
chunk_size[i] = avio_rl32(pb);
for(i=0; i < frame_count;i++)
}
for(i=0; i < frame_count;i++) {
if (avio_feof(pb))
return AVERROR_INVALIDDATA;
chunk_offset[i] = avio_rl32(pb);
for(i=0; i < frame_count;i++)
}
for(i=0; i < frame_count;i++) {
if (avio_feof(pb))
return AVERROR_INVALIDDATA;
audio_size[i] = avio_rl32(pb) & 0xFFFF;
}
/** build the sample index */
for(i=0;i<frame_count;i++){
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment