Mercurial > mplayer.hg
changeset 31605:21ac1f3cfb7f
Add packet->len checks to avoid out-of-bounds reads and negative
es->size values.
| author | reimar |
|---|---|
| date | Sat, 10 Jul 2010 16:48:59 +0000 |
| parents | a513b4166abd |
| children | d48795123d88 |
| files | libmpdemux/demux_ts.c |
| diffstat | 1 files changed, 5 insertions(+), 5 deletions(-) [+] |
line wrap: on
line diff
--- a/libmpdemux/demux_ts.c Sat Jul 10 16:44:02 2010 +0000 +++ b/libmpdemux/demux_ts.c Sat Jul 10 16:48:59 2010 +0000 @@ -1484,7 +1484,7 @@ if( (type_from_pmt == AUDIO_A52) || /* A52 - raw */ - (p[0] == 0x0B && p[1] == 0x77) /* A52 - syncword */ + (packet_len >= 2 && p[0] == 0x0B && p[1] == 0x77) /* A52 - syncword */ ) { mp_msg(MSGT_DEMUX, MSGL_DBG2, "A52 RAW OR SYNCWORD\n"); @@ -1497,7 +1497,7 @@ } /* SPU SUBS */ else if(type_from_pmt == SPU_DVB || - ((p[0] == 0x20) && pes_is_aligned)) // && p[1] == 0x00)) + (packet_len >= 1 && (p[0] == 0x20) && pes_is_aligned)) // && p[1] == 0x00)) { es->start = p; es->size = packet_len; @@ -1506,7 +1506,7 @@ return 1; } - else if (pes_is_aligned && ((p[0] & 0xE0) == 0x20)) //SPU_DVD + else if (pes_is_aligned && packet_len >= 1 && ((p[0] & 0xE0) == 0x20)) //SPU_DVD { //DVD SUBS es->start = p+1; @@ -1516,7 +1516,7 @@ return 1; } - else if (pes_is_aligned && (p[0] & 0xF8) == 0x80) + else if (pes_is_aligned && packet_len >= 4 && (p[0] & 0xF8) == 0x80) { mp_msg(MSGT_DEMUX, MSGL_DBG2, "A52 WITH HEADER\n"); es->start = p+4; @@ -1526,7 +1526,7 @@ return 1; } - else if (pes_is_aligned && ((p[0]&0xf0) == 0xa0)) + else if (pes_is_aligned && packet_len >= 1 && ((p[0]&0xf0) == 0xa0)) { int pcm_offset;