From 4c71d7270104ce148faa2e44237450a9d303de96 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Mon, 22 Jan 2007 16:37:45 +0000 Subject: check fragment offset and size yes this too could have been exploitable ... Originally committed as revision 7650 to svn://svn.ffmpeg.org/ffmpeg/trunk --- libavformat/asf.c | 8 ++++++++ libavformat/asf.h | 4 ++-- 2 files changed, 10 insertions(+), 2 deletions(-) (limited to 'libavformat') diff --git a/libavformat/asf.c b/libavformat/asf.c index fc3a7dead8..ef7ae5e6ea 100644 --- a/libavformat/asf.c +++ b/libavformat/asf.c @@ -703,6 +703,14 @@ static int asf_read_packet(AVFormatContext *s, AVPacket *pkt) asf->packet_size_left -= asf->packet_frag_size; if (asf->packet_size_left < 0) continue; + + if( asf->packet_frag_offset >= asf_st->pkt.size + || asf->packet_frag_size > asf_st->pkt.size - asf->packet_frag_offset){ + av_log(s, AV_LOG_ERROR, "packet fragment position invalid %u,%u not in %u\n", + asf->packet_frag_offset, asf->packet_frag_size, asf_st->pkt.size); + continue; + } + get_buffer(pb, asf_st->pkt.data + asf->packet_frag_offset, asf->packet_frag_size); asf_st->frag_offset += asf->packet_frag_size; diff --git a/libavformat/asf.h b/libavformat/asf.h index 0aabe793a7..457f92d199 100644 --- a/libavformat/asf.h +++ b/libavformat/asf.h @@ -106,8 +106,8 @@ typedef struct { int packet_replic_size; int packet_key_frame; int packet_padsize; - int packet_frag_offset; - int packet_frag_size; + unsigned int packet_frag_offset; + unsigned int packet_frag_size; int packet_frag_timestamp; int packet_multi_size; int packet_obj_size; -- cgit v1.2.3