diff options
| author | Jacob Trimble | 2018-08-13 15:17:11 -0700 |
|---|---|---|
| committer | Michael Niedermayer | 2018-08-15 01:33:45 +0200 |
| commit | 67599812a36a5cc727522760b56930868f93ba0d (patch) | |
| tree | 2d1a773a960c28d8710f375b3bb11b705ba0d65f /libavutil | |
| parent | f5559dd8694cbc28b8dbb501378270077f5a72b5 (diff) | |
avutil/encryption_info: Fix size calculation.
Found by Chrome's ClusterFuzz: https://crbug.com/873693
Signed-off-by: Jacob Trimble <modmaker@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavutil')
| -rw-r--r-- | libavutil/encryption_info.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/libavutil/encryption_info.c b/libavutil/encryption_info.c index 3b7e16cd0c..812c704776 100644 --- a/libavutil/encryption_info.c +++ b/libavutil/encryption_info.c @@ -297,14 +297,14 @@ uint8_t *av_encryption_init_info_add_side_data(const AVEncryptionInitInfo *info, temp_side_data_size = 4; init_info_count = 0; for (cur_info = info; cur_info; cur_info = cur_info->next) { - temp_side_data_size += (uint64_t)FF_ENCRYPTION_INIT_INFO_EXTRA + info->system_id_size + info->data_size; + temp_side_data_size += (uint64_t)FF_ENCRYPTION_INIT_INFO_EXTRA + cur_info->system_id_size + cur_info->data_size; if (init_info_count == UINT32_MAX || temp_side_data_size > UINT32_MAX) { return NULL; } init_info_count++; - if (info->num_key_ids) { - temp_side_data_size += (uint64_t)info->num_key_ids * info->key_id_size; + if (cur_info->num_key_ids) { + temp_side_data_size += (uint64_t)cur_info->num_key_ids * cur_info->key_id_size; if (temp_side_data_size > UINT32_MAX) { return NULL; } |