Mercurial > mplayer.hg

changeset 27270:44ebd7860248

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Make sure demuxed ASF packet is properly padded after descrambling
author reimar
date Wed, 16 Jul 2008 16:43:40 +0000
parents 21e634c01f9f
children e96d8e20bf69
files libmpdemux/demux_asf.c
diffstat 1 files changed, 4 insertions(+), 1 deletions(-) [+]
line wrap: on
line diff
--- a/libmpdemux/demux_asf.c	Wed Jul 16 16:18:25 2008 +0000
+++ b/libmpdemux/demux_asf.c	Wed Jul 16 16:43:40 2008 +0000
@@ -50,9 +50,12 @@
 }
 
 static void asf_descrambling(unsigned char **src,unsigned len, struct asf_priv* asf){
-  unsigned char *dst=malloc(len);
+  unsigned char *dst;
   unsigned char *s2=*src;
   unsigned i=0,x,y;
+  if (len > UINT_MAX - FF_INPUT_BUFFER_PADDING_SIZE)
+	return;
+  dst = malloc(len + FF_INPUT_BUFFER_PADDING_SIZE);
   while(len>=asf->scrambling_h*asf->scrambling_w*asf->scrambling_b+i){
 //    mp_msg(MSGT_DEMUX,MSGL_DBG4,"descrambling! (w=%d  b=%d)\n",w,asf_scrambling_b);
 	//i+=asf_scrambling_h*asf_scrambling_w;