changeset 25453:7cde1324cf14

100l, buffer bound checks work better when done _before_ access.
author reimar
date Fri, 21 Dec 2007 11:34:04 +0000
parents 25fc785eab22
children e2bbaf29e61e
files stream/asf_streaming.c
diffstat 1 files changed, 2 insertions(+), 3 deletions(-) [+]
line wrap: on
line diff
--- a/stream/asf_streaming.c	Fri Dec 21 11:30:55 2007 +0000
+++ b/stream/asf_streaming.c	Fri Dec 21 11:34:04 2007 +0000
@@ -310,21 +310,20 @@
 	char *end = &buffer[size];
 	
 	mp_msg(MSGT_NETWORK, MSGL_V, "Stream bitrate properties object\n");
+		if (ptr + 2 > end) goto len_err_out;
 		stream_count = AV_RL16(ptr);
 		ptr += 2;
-		if (ptr > end) goto len_err_out;
 		mp_msg(MSGT_NETWORK, MSGL_V, " stream count=[0x%x][%u]\n",
 		        stream_count, stream_count );
 		for( i=0 ; i<stream_count ; i++ ) {
 			uint32_t rate;
 			int id;
 			int j;
+			if (ptr + 6 > end) goto len_err_out;
 			id = AV_RL16(ptr);
 			ptr += 2;
-			if (ptr > end) goto len_err_out;
 			rate = AV_RL32(ptr);
 			ptr += 4;
-			if (ptr > end) goto len_err_out;
 			mp_msg(MSGT_NETWORK, MSGL_V,
                                 "  stream id=[0x%x][%u]\n", id, id);
 			mp_msg(MSGT_NETWORK, MSGL_V,