westwooddemuxer: Fix 1gb alloc

Fixes Ticket765 Bug Found by: Diana Elena Muscalu Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
13 years ago · f68b19fc28
parent 6f2054c589
commit f68b19fc28
1 changed files with 7 additions and 0 deletions
--- a/libavformat/westwood.c
+++ b/libavformat/westwood.c
@ -320,8 +320,15 @@ static int wsvqa_read_packet(AVFormatContext *s,
    int skip_byte;

    while (avio_read(pb, preamble, VQA_PREAMBLE_SIZE) == VQA_PREAMBLE_SIZE) {
+        int64_t filesize= avio_size(s->pb);
        chunk_type = AV_RB32(&preamble[0]);
        chunk_size = AV_RB32(&preamble[4]);
+
+        if(chunk_size > filesize){
+            av_log(s, AV_LOG_ERROR, "Chunk with size %d truncated\n", chunk_size);
+            chunk_size= filesize;
+        }
+
        skip_byte = chunk_size & 0x01;

        if ((chunk_type == SND1_TAG) || (chunk_type == SND2_TAG) || (chunk_type == VQFR_TAG)) {