comparison libmpdemux/asfheader.c @ 18001:a2683ee7cb5a

fix descrambling of asf file, where signed buffer could cause erroneous values to be filled in descrable variables, add misssing check for one of these variables and restore sign of these variables as insurance that these checks will work even in such case.

18000:3b4e03cb518d

  // find stream headers
  pos = 0;
  while ((pos = find_asf_guid(hdr, asf_stream_header_guid, pos, hdr_len)) >= 0)
  {
    ASF_stream_header_t *streamh = (ASF_stream_header_t *)&hdr[pos];
    char *buffer;
    pos += sizeof(ASF_stream_header_t);
    if (pos > hdr_len) goto len_err_out;
    le2me_ASF_stream_header_t(streamh);
    mp_msg(MSGT_HEADER, MSGL_V, "stream type: %s\n",
            asf_chunk_type(streamh->type));

          pos += streamh->stream_size;
          if (pos > hdr_len) goto len_err_out;
          asf->scrambling_h=buffer[0];
          asf->scrambling_w=(buffer[2]<<8)|buffer[1];
          asf->scrambling_b=(buffer[4]<<8)|buffer[3];
  	  asf->scrambling_w/=asf->scrambling_b;
	} else {
	  asf->scrambling_b=asf->scrambling_h=asf->scrambling_w=1;
	}
	mp_msg(MSGT_HEADER,MSGL_V,"ASF: audio scrambling: %d x %d x %d\n",asf->scrambling_h,asf->scrambling_w,asf->scrambling_b);
	//if(demuxer->audio->id==-1) demuxer->audio->id=streamh.stream_no & 0x7F;

18001:a2683ee7cb5a

  // find stream headers
  pos = 0;
  while ((pos = find_asf_guid(hdr, asf_stream_header_guid, pos, hdr_len)) >= 0)
  {
    ASF_stream_header_t *streamh = (ASF_stream_header_t *)&hdr[pos];
    uint8_t *buffer;
    pos += sizeof(ASF_stream_header_t);
    if (pos > hdr_len) goto len_err_out;
    le2me_ASF_stream_header_t(streamh);
    mp_msg(MSGT_HEADER, MSGL_V, "stream type: %s\n",
            asf_chunk_type(streamh->type));

          pos += streamh->stream_size;
          if (pos > hdr_len) goto len_err_out;
          asf->scrambling_h=buffer[0];
          asf->scrambling_w=(buffer[2]<<8)|buffer[1];
          asf->scrambling_b=(buffer[4]<<8)|buffer[3];
          if(asf->scrambling_b>0){
            asf->scrambling_w/=asf->scrambling_b;
          }
	} else {
	  asf->scrambling_b=asf->scrambling_h=asf->scrambling_w=1;
	}
	mp_msg(MSGT_HEADER,MSGL_V,"ASF: audio scrambling: %d x %d x %d\n",asf->scrambling_h,asf->scrambling_w,asf->scrambling_b);
	//if(demuxer->audio->id==-1) demuxer->audio->id=streamh.stream_no & 0x7F;