diff --git a/libavformat/flvdec.c b/libavformat/flvdec.c index 6dce9b8dcd..01c845f58d 100644 --- a/libavformat/flvdec.c +++ b/libavformat/flvdec.c @@ -42,6 +42,8 @@ #define RESYNC_BUFFER_SIZE (1<<20) +#define MAX_DEPTH 16 ///< arbitrary limit to prevent unbounded recursion + typedef struct FLVContext { const AVClass *class; ///< Class for private options. int trust_metadata; ///< configure streams according onMetaData @@ -494,6 +496,9 @@ static int amf_parse_object(AVFormatContext *s, AVStream *astream, double num_val; amf_date date; + if (depth > MAX_DEPTH) + return AVERROR_PATCHWELCOME; + num_val = 0; ioc = s->pb; if (avio_feof(ioc))