You've already forked FFmpeg
mirror of
https://github.com/FFmpeg/FFmpeg.git
synced 2025-08-15 14:13:16 +02:00
matroskadec: Check for overflows in xiph lace decoding
This also detects errors earlier Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
@@ -1992,18 +1992,18 @@ static int matroska_parse_laces(MatroskaDemuxContext *matroska, uint8_t **buf,
|
|||||||
uint32_t total = 0;
|
uint32_t total = 0;
|
||||||
for (n = 0; res == 0 && n < *laces - 1; n++) {
|
for (n = 0; res == 0 && n < *laces - 1; n++) {
|
||||||
while (1) {
|
while (1) {
|
||||||
if (size == 0) {
|
if (size <= total) {
|
||||||
res = AVERROR_INVALIDDATA;
|
res = AVERROR_INVALIDDATA;
|
||||||
break;
|
break;
|
||||||
}
|
}
|
||||||
temp = *data;
|
temp = *data;
|
||||||
|
total += temp;
|
||||||
lace_size[n] += temp;
|
lace_size[n] += temp;
|
||||||
data += 1;
|
data += 1;
|
||||||
size -= 1;
|
size -= 1;
|
||||||
if (temp != 0xff)
|
if (temp != 0xff)
|
||||||
break;
|
break;
|
||||||
}
|
}
|
||||||
total += lace_size[n];
|
|
||||||
}
|
}
|
||||||
if (size <= total) {
|
if (size <= total) {
|
||||||
res = AVERROR_INVALIDDATA;
|
res = AVERROR_INVALIDDATA;
|
||||||
|
Reference in New Issue
Block a user