[FFmpeg-cvslog] r12205 - trunk/libavformat/aiff.c

[bcoudurier]

Author: bcoudurier
Date: Mon Feb 25 13:38:37 2008
New Revision: 12205

Log:
10l, protect malloc overflow

Modified:
   trunk/libavformat/aiff.c

Modified: trunk/libavformat/aiff.c
==============================================================================
--- trunk/libavformat/aiff.c	(original)
+++ trunk/libavformat/aiff.c	Mon Feb 25 13:38:37 2008
@@ -368,6 +368,8 @@ static int aiff_read_header(AVFormatCont
             url_fskip(pb, size - 8);
             break;
         case MKTAG('w', 'a', 'v', 'e'):
+            if ((uint64_t)size > (1<<30))
+                return -1;
             st->codec->extradata = av_mallocz(size + FF_INPUT_BUFFER_PADDING_SIZE);
             if (!st->codec->extradata)
                 return AVERROR(ENOMEM);