avfilter/formats: Fix heap-buffer overflow when merging channel layouts

[ffmpeg] / libavformat / sdp.c

diff --git a/libavformat/sdp.c b/libavformat/sdp.c
index a5d202e99cb28473194e15fd7ce9a5476feb44ec..2ce1a62262defbd965e0720ab9283ba56b533fa3 100644 (file)
--- a/libavformat/sdp.c
+++ b/libavformat/sdp.c
@@ -212,7 +212,7 @@ static char *extradata2psets(AVFormatContext *s, AVCodecParameters *par)
         p += strlen(p);
         r = r1;
     }
-    if (sps && sps_end - sps >= 4) {
+    if (sps && sps_end - sps >= 4 && p - psets <= MAX_PSET_SIZE - strlen(profile_string) - 7) {
         memcpy(p, profile_string, strlen(profile_string));
         p += strlen(p);
         ff_data_to_hex(p, sps + 1, 3, 0);
@@ -347,7 +347,8 @@ static char *extradata2config(AVFormatContext *s, AVCodecParameters *par)
 
 static char *xiph_extradata2config(AVFormatContext *s, AVCodecParameters *par)
 {
-    char *config, *encoded_config;
+    uint8_t *config;
+    char *encoded_config;
     const uint8_t *header_start[3];
     int headers_len, header_len[3], config_len;
     int first_header_size;