From: Debian Multimedia Maintainers <pkg-multimedia-maintainers@lists.alioth.debian.org>
Date: Tue, 14 Jun 2016 12:13:25 +0000 (+0000)
Subject: CVE-2016-2326
X-Git-Tag: archive/raspbian/6%0.8.20-0+deb7u1+rpi1~1^2~3
X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=19b85150f1541668e0ff81ae381f2e4f3fef1c9a;p=libav.git

CVE-2016-2326


Gbp-Pq: Name CVE-2016-2326.patch
---

diff --git a/libavformat/asfenc.c b/libavformat/asfenc.c
index 1cfc857..d1ab2b7 100644
--- a/libavformat/asfenc.c
+++ b/libavformat/asfenc.c
@@ -800,6 +800,11 @@ static int asf_write_packet(AVFormatContext *s, AVPacket *pkt)
 
     pts = (pkt->pts != AV_NOPTS_VALUE) ? pkt->pts : pkt->dts;
     assert(pts != AV_NOPTS_VALUE);
+    if (   pts < - PREROLL_TIME
+        || pts > (INT_MAX-3)/10000LL * ASF_INDEXED_INTERVAL - PREROLL_TIME) {
+        av_log(s, AV_LOG_ERROR, "input pts %"PRId64" is invalid\n", pts);
+        return AVERROR(EINVAL);
+    }
     duration = pts * 10000;
     asf->duration= FFMAX(asf->duration, duration + pkt->duration * 10000);