From 3ca1ad46371272335d386bbbbfaf48ec3924113f Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sat, 28 Jul 2018 15:03:50 +0200 Subject: [PATCH] avformat/flvenc: Check audio packet size Fixes: Assertion failure Fixes: assert_flvenc.c:941_1.swf Found-by: #CHEN HONGXU# Signed-off-by: Michael Niedermayer Gbp-Pq: Name CVE-2018-15822.patch --- libavformat/flvenc.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libavformat/flvenc.c b/libavformat/flvenc.c index cc4c782..366eb3e 100644 --- a/libavformat/flvenc.c +++ b/libavformat/flvenc.c @@ -438,6 +438,11 @@ static int flv_write_packet(AVFormatContext *s, AVPacket *pkt) uint8_t *data = NULL; int flags = 0, flags_size; + if (enc->codec_type == AVMEDIA_TYPE_AUDIO && !pkt->size) { + av_log(s, AV_LOG_WARNING, "Empty audio Packet\n"); + return AVERROR(EINVAL); + } + if (enc->codec_id == AV_CODEC_ID_VP6F || enc->codec_id == AV_CODEC_ID_VP6A || enc->codec_id == AV_CODEC_ID_AAC) flags_size = 2; -- 2.30.2