From 58720ebd9e671f654d89d8e401d0b4dffb79122b Mon Sep 17 00:00:00 2001 From: Reimar Döffinger Date: Sun, 20 Apr 2008 23:33:49 +0000 Subject: Add checks to ff_split_xiph_headers to ensure that returned header_len and header_start values are always valid. Fixes a crash with http://samples.mplayerhq.hu/ogg/mmw-deadzy.ogg (still does not play though). Originally committed as revision 12913 to svn://svn.ffmpeg.org/ffmpeg/trunk --- libavcodec/xiph.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) (limited to 'libavcodec/xiph.c') diff --git a/libavcodec/xiph.c b/libavcodec/xiph.c index 65c9d56037..fc197b6bb6 100644 --- a/libavcodec/xiph.c +++ b/libavcodec/xiph.c @@ -26,20 +26,27 @@ int ff_split_xiph_headers(uint8_t *extradata, int extradata_size, { int i, j; - if (AV_RB16(extradata) == first_header_size) { + if (extradata_size >= 6 && AV_RB16(extradata) == first_header_size) { + int overall_len = 6; for (i=0; i<3; i++) { header_len[i] = AV_RB16(extradata); extradata += 2; header_start[i] = extradata; extradata += header_len[i]; + if (overall_len > extradata_size - header_len[i]) + return -1; + overall_len += header_len[i]; } - } else if (extradata[0] == 2) { + } else if (extradata_size >= 3 && extradata_size < INT_MAX - 0x1ff && extradata[0] == 2) { + int overall_len = 3; for (i=0,j=1; i<2; i++,j++) { header_len[i] = 0; - for (; j= extradata_size) + overall_len += extradata[j]; + if (overall_len > extradata_size) return -1; header_len[i] += extradata[j]; -- cgit v1.2.3