Mercurial > libavformat.hg

changeset 2595:f9cfd91f344a libavformat

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
fix buffer overread with invalid Vorbis header
author mru
date Wed, 10 Oct 2007 22:59:31 +0000
parents a7755990bb9c
children 9e91148f1d44
files oggparsevorbis.c
diffstat 1 files changed, 13 insertions(+), 5 deletions(-) [+]
line wrap: on
line diff
--- a/oggparsevorbis.c	Wed Oct 10 22:58:16 2007 +0000
+++ b/oggparsevorbis.c	Wed Oct 10 22:59:31 2007 +0000
@@ -32,17 +32,17 @@
 extern int
 vorbis_comment(AVFormatContext * as, uint8_t *buf, int size)
 {
-    char *p = buf;
-    int s, n, j;
+    uint8_t *p = buf;
+    unsigned s, n, j;
 
-    if (size < 4)
+    if (size < 8) /* must have vendor_length and user_comment_list_length */
         return -1;
 
     s = AV_RL32(p);
     p += 4;
     size -= 4;
 
-    if (size < s + 4)
+    if (size - 4 < s)
         return -1;
 
     p += s;
@@ -174,12 +174,19 @@
             return 0;
     }
 
+    if (os->psize < 1)
+        return -1;
+
     priv = os->private;
     priv->len[os->seq] = os->psize;
     priv->packet[os->seq] = av_mallocz(os->psize);
     memcpy(priv->packet[os->seq], os->buf + os->pstart, os->psize);
     if (os->buf[os->pstart] == 1) {
         uint8_t *p = os->buf + os->pstart + 11; //skip up to the audio channels
+
+        if (os->psize != 30)
+            return -1;
+
         st->codec->channels = *p++;
         st->codec->sample_rate = AV_RL32(p);
         p += 8; //skip maximum and and nominal bitrate
@@ -191,7 +198,8 @@
         st->time_base.num = 1;
         st->time_base.den = st->codec->sample_rate;
     } else if (os->buf[os->pstart] == 3) {
-        vorbis_comment (s, os->buf + os->pstart + 7, os->psize - 8);
+        if (os->psize > 8)
+            vorbis_comment (s, os->buf + os->pstart + 7, os->psize - 8);
     } else {
         st->codec->extradata_size =
             fixup_vorbis_headers(s, priv, &st->codec->extradata);