58 lines
1.5 KiB
Diff
58 lines
1.5 KiB
Diff
From c7f421bd0f01a725c4cc65223546361226013c1c Mon Sep 17 00:00:00 2001
|
|
From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
|
|
Date: Tue, 25 Jun 2024 10:36:33 +0800
|
|
Subject: [PATCH] CVE-2022-3341
|
|
|
|
---
|
|
libavformat/nutdec.c | 16 ++++++++++++----
|
|
1 file changed, 12 insertions(+), 4 deletions(-)
|
|
|
|
diff --git a/libavformat/nutdec.c b/libavformat/nutdec.c
|
|
index 979cb9a..886b5c6 100644
|
|
--- a/libavformat/nutdec.c
|
|
+++ b/libavformat/nutdec.c
|
|
@@ -346,8 +346,12 @@ static int decode_main_header(NUTContext *nut)
|
|
ret = AVERROR(ENOMEM);
|
|
goto fail;
|
|
}
|
|
- for (i = 0; i < stream_count; i++)
|
|
- avformat_new_stream(s, NULL);
|
|
+ for (i = 0; i < stream_count; i++) {
|
|
+ if (!avformat_new_stream(s, NULL)) {
|
|
+ ret = AVERROR(ENOMEM);
|
|
+ goto fail;
|
|
+ }
|
|
+ }
|
|
|
|
return 0;
|
|
fail:
|
|
@@ -793,19 +797,23 @@ static int nut_read_header(AVFormatContext *s)
|
|
NUTContext *nut = s->priv_data;
|
|
AVIOContext *bc = s->pb;
|
|
int64_t pos;
|
|
- int initialized_stream_count;
|
|
+ int initialized_stream_count, ret;
|
|
|
|
nut->avf = s;
|
|
|
|
/* main header */
|
|
pos = 0;
|
|
+ ret = 0;
|
|
do {
|
|
+ if (ret == AVERROR(ENOMEM))
|
|
+ return ret;
|
|
+
|
|
pos = find_startcode(bc, MAIN_STARTCODE, pos) + 1;
|
|
if (pos < 0 + 1) {
|
|
av_log(s, AV_LOG_ERROR, "No main startcode found.\n");
|
|
goto fail;
|
|
}
|
|
- } while (decode_main_header(nut) < 0);
|
|
+ } while ((ret = decode_main_header(nut)) < 0);
|
|
|
|
/* stream headers */
|
|
pos = 0;
|
|
--
|
|
2.43.0
|
|
|