vf_drawtext: Do not leak the mmapped textfile

Message ID 20141018152101.BF0EE5DCD2@aruru.libav.org
State New
Headers show

Commit Message

Janne Grunau Oct. 18, 2014, 3:21 p.m.
Module: libav
Branch: master
Commit: f401792595dd7760f531e8a3bd2336e9033bd45a

Author:    Luca Barbato <lu_zero@gentoo.org>
Committer: Vittorio Giovara <vittorio.giovara@gmail.com>
Date:      Fri Oct 17 10:07:10 2014 +0100

vf_drawtext: Do not leak the mmapped textfile

And validate its size while at it.

CC: libav-stable@libav.org
Bug-Id: CID 1244189

---

 libavfilter/vf_drawtext.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

Patch

diff --git a/libavfilter/vf_drawtext.c b/libavfilter/vf_drawtext.c
index 892104d..d954fdf 100644
--- a/libavfilter/vf_drawtext.c
+++ b/libavfilter/vf_drawtext.c
@@ -398,8 +398,11 @@  static av_cold int init(AVFilterContext *ctx)
             return err;
         }
 
-        if (!(s->text = av_malloc(textbuf_size+1)))
+        if (textbuf_size > SIZE_MAX - 1 ||
+            !(s->text = av_malloc(textbuf_size + 1))) {
+            av_file_unmap(textbuf, textbuf_size);
             return AVERROR(ENOMEM);
+        }
         memcpy(s->text, textbuf, textbuf_size);
         s->text[textbuf_size] = 0;
         av_file_unmap(textbuf, textbuf_size);