Mercurial > libavcodec.hg

comparison xiph.c @ 6656:b1049dd41dd4 libavcodec

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Add checks to ff_split_xiph_headers to ensure that returned header_len and header_start values are always valid. Fixes a crash with http://samples.mplayerhq.hu/ogg/mmw-deadzy.ogg (still does not play though).
author reimar
date Sun, 20 Apr 2008 23:33:49 +0000
parents 7595ead28402
children 2574def95b50
comparison
equal deleted inserted replaced
6655:22cca5d3173a 6656:b1049dd41dd4
24 int first_header_size, uint8_t *header_start[3], 24 int first_header_size, uint8_t *header_start[3],
25 int header_len[3]) 25 int header_len[3])
26 { 26 {
27 int i, j; 27 int i, j;
28 28
29 if (AV_RB16(extradata) == first_header_size) { 29 if (extradata_size >= 6 && AV_RB16(extradata) == first_header_size) {
30 int overall_len = 6;
30 for (i=0; i<3; i++) { 31 for (i=0; i<3; i++) {
31 header_len[i] = AV_RB16(extradata); 32 header_len[i] = AV_RB16(extradata);
32 extradata += 2; 33 extradata += 2;
33 header_start[i] = extradata; 34 header_start[i] = extradata;
34 extradata += header_len[i]; 35 extradata += header_len[i];
36 if (overall_len > extradata_size - header_len[i])
37 return -1;
38 overall_len += header_len[i];
35 } 39 }
36 } else if (extradata[0] == 2) { 40 } else if (extradata_size >= 3 && extradata_size < INT_MAX - 0x1ff && extradata[0] == 2) {
41 int overall_len = 3;
37 for (i=0,j=1; i<2; i++,j++) { 42 for (i=0,j=1; i<2; i++,j++) {
38 header_len[i] = 0; 43 header_len[i] = 0;
39 for (; j<extradata_size && extradata[j]==0xff; j++) { 44 for (; overall_len < extradata_size && extradata[j]==0xff; j++) {
40 header_len[i] += 0xff; 45 header_len[i] += 0xff;
46 overall_len += 0xff + 1;
41 } 47 }
42 if (j >= extradata_size) 48 overall_len += extradata[j];
49 if (overall_len > extradata_size)
43 return -1; 50 return -1;
44 51
45 header_len[i] += extradata[j]; 52 header_len[i] += extradata[j];
46 } 53 }
47 header_len[2] = extradata_size - header_len[0] - header_len[1] - j; 54 header_len[2] = extradata_size - header_len[0] - header_len[1] - j;