Browse Source

avformat/flac_picture: allocate buffer padding for picture

Fixes: heap array overread
Fixes: asan_heap-oob_14876d9_4706_cov_815472558_cover_art.flac
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
tags/n2.2-rc1
Michael Niedermayer 12 years ago
parent
commit
fff2953163
1 changed files with 1 additions and 1 deletions
  1. +1
    -1
      libavformat/flac_picture.c

+ 1
- 1
libavformat/flac_picture.c View File

@@ -107,7 +107,7 @@ int ff_flac_parse_picture(AVFormatContext *s, uint8_t *buf, int buf_size)
ret = AVERROR_INVALIDDATA;
goto fail;
}
if (!(data = av_buffer_alloc(len))) {
if (!(data = av_buffer_alloc(len + FF_INPUT_BUFFER_PADDING_SIZE))) {
RETURN_ERROR(AVERROR(ENOMEM));
}
if (avio_read(pb, data->data, len) != len) {


Loading…
Cancel
Save