Browse code
avformat/aviobuf: Check that avio_seek() target is non negative
Fixes out of array access
Suggested-by: Andrew Scherkus <scherkus@google.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Michael Niedermayer authored on 2014/12/15 01:26:11Showing 1 changed files
| ... | ... |
@@ -223,6 +223,9 @@ int64_t avio_seek(AVIOContext *s, int64_t offset, int whence) |
| 223 | 223 |
return offset1; |
| 224 | 224 |
offset += offset1; |
| 225 | 225 |
} |
| 226 |
+ if (offset < 0) |
|
| 227 |
+ return AVERROR(EINVAL); |
|
| 228 |
+ |
|
| 226 | 229 |
offset1 = offset - pos; |
| 227 | 230 |
if (!s->must_flush && (!s->direct || !s->seek) && |
| 228 | 231 |
offset1 >= 0 && offset1 <= buffer_size) {
|