mmsh: fixed printf injection bug in mmsh request

[ffmpeg] / libavformat / daud.c

diff --git a/libavformat/daud.c b/libavformat/daud.c
index 7aa1b6dad2516730fcf2c0621cee5ee21f0181a8..6a36d28acb84adfec6f2d84117904ca31f039b6e 100644 (file)
--- a/libavformat/daud.c
+++ b/libavformat/daud.c
@@ -57,6 +57,11 @@ static int daud_write_header(struct AVFormatContext *s)
 
 static int daud_write_packet(struct AVFormatContext *s, AVPacket *pkt)
 {
+    if (pkt->size > 65535) {
+        av_log(s, AV_LOG_ERROR,
+               "Packet size too large for s302m. (%d > 65535)\n", pkt->size);
+        return -1;
+    }
     avio_wb16(s->pb, pkt->size);
     avio_wb16(s->pb, 0x8010); // unknown
     avio_write(s->pb, pkt->data, pkt->size);