Mercurial > mplayer.hg
changeset 27643:28b01d8aa62f
Apply patch for oCERT #2008-013 / CVE-2008-3827
| author | reimar |
|---|---|
| date | Tue, 30 Sep 2008 10:44:50 +0000 |
| parents | cca016b2c472 |
| children | 92787d5c8f97 |
| files | libmpdemux/demux_real.c |
| diffstat | 1 files changed, 3 insertions(+), 0 deletions(-) [+] |
line wrap: on
line diff
--- a/libmpdemux/demux_real.c Mon Sep 29 20:44:38 2008 +0000 +++ b/libmpdemux/demux_real.c Tue Sep 30 10:44:50 2008 +0000 @@ -947,6 +947,7 @@ // last fragment! if(dp_hdr->len!=vpkg_length-vpkg_offset) mp_msg(MSGT_DEMUX,MSGL_V,"warning! assembled.len=%d frag.len=%d total.len=%d \n",dp->len,vpkg_offset,vpkg_length-vpkg_offset); + if (vpkg_offset > dp->len - sizeof(dp_hdr_t) - dp_hdr->len) vpkg_offset = dp->len - sizeof(dp_hdr_t) - dp_hdr->len; stream_read(demuxer->stream, dp_data+dp_hdr->len, vpkg_offset); if((dp_data[dp_hdr->len]&0x20) && (sh_video->format==0x30335652)) --dp_hdr->chunks; else dp_hdr->len+=vpkg_offset; @@ -970,6 +971,7 @@ // non-last fragment: if(dp_hdr->len!=vpkg_offset) mp_msg(MSGT_DEMUX,MSGL_V,"warning! assembled.len=%d offset=%d frag.len=%d total.len=%d \n",dp->len,vpkg_offset,len,vpkg_length); + if (len > dp->len - sizeof(dp_hdr_t) - dp_hdr->len) len = dp->len - sizeof(dp_hdr_t) - dp_hdr->len; stream_read(demuxer->stream, dp_data+dp_hdr->len, len); if((dp_data[dp_hdr->len]&0x20) && (sh_video->format==0x30335652)) --dp_hdr->chunks; else dp_hdr->len+=len; @@ -992,6 +994,7 @@ extra[0]=1; extra[1]=0; // offset of the first chunk if(0x00==(vpkg_header&0xc0)){ // first fragment: + if (len > dp->len - sizeof(dp_hdr_t)) len = dp->len - sizeof(dp_hdr_t); dp_hdr->len=len; stream_read(demuxer->stream, dp_data, len); ds->asf_packet=dp;