changeset 15426:79008c38fcd9

prevent possible exploit
author nicodvb
date Fri, 13 May 2005 00:00:54 +0000
parents 2071633f9bdc
children 21378d633887
files libmpdemux/demux_ogg.c
diffstat 1 files changed, 3 insertions(+), 1 deletions(-) [+]
line wrap: on
line diff
--- a/libmpdemux/demux_ogg.c	Thu May 12 23:32:26 2005 +0000
+++ b/libmpdemux/demux_ogg.c	Fri May 13 00:00:54 2005 +0000
@@ -758,6 +758,7 @@
   ogg_packet op[3];
   unsigned char *buf[3];
   unsigned char *ptr;
+  unsigned int len;
 
   for(i = 0; i < 3; i++) {
     op[i].bytes = ds_get_packet(sh->ds, &(op[i].packet));
@@ -772,7 +773,8 @@
     memcpy(buf[i], op[i].packet, op[i].bytes);
   }
 
-  sh->wf = (WAVEFORMATEX*)calloc(1, sizeof(WAVEFORMATEX) + op[0].bytes + op[1].bytes + op[2].bytes + 64);
+  len = op[0].bytes + op[1].bytes + op[2].bytes;
+  sh->wf = (WAVEFORMATEX*)calloc(1, sizeof(WAVEFORMATEX) + len + len/255 + 64);
   ptr = (unsigned char*) (sh->wf+1);
 
   ptr[0] = 2;