From 58720ebd9e671f654d89d8e401d0b4dffb79122b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Reimar=20D=C3=B6ffinger?= <Reimar.Doeffinger@gmx.de>
Date: Sun, 20 Apr 2008 23:33:49 +0000
Subject: [PATCH] Add checks to ff_split_xiph_headers to ensure that returned
 header_len and header_start values are always valid. Fixes a crash with
 http://samples.mplayerhq.hu/ogg/mmw-deadzy.ogg (still does not play though).

Originally committed as revision 12913 to svn://svn.ffmpeg.org/ffmpeg/trunk
---
 libavcodec/xiph.c | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/libavcodec/xiph.c b/libavcodec/xiph.c
index 65c9d56037..fc197b6bb6 100644
--- a/libavcodec/xiph.c
+++ b/libavcodec/xiph.c
@@ -26,20 +26,27 @@ int ff_split_xiph_headers(uint8_t *extradata, int extradata_size,
 {
     int i, j;
 
-    if (AV_RB16(extradata) == first_header_size) {
+    if (extradata_size >= 6 && AV_RB16(extradata) == first_header_size) {
+        int overall_len = 6;
         for (i=0; i<3; i++) {
             header_len[i] = AV_RB16(extradata);
             extradata += 2;
             header_start[i] = extradata;
             extradata += header_len[i];
+            if (overall_len > extradata_size - header_len[i])
+                return -1;
+            overall_len += header_len[i];
         }
-    } else if (extradata[0] == 2) {
+    } else if (extradata_size >= 3 && extradata_size < INT_MAX - 0x1ff && extradata[0] == 2) {
+        int overall_len = 3;
         for (i=0,j=1; i<2; i++,j++) {
             header_len[i] = 0;
-            for (; j<extradata_size && extradata[j]==0xff; j++) {
+            for (; overall_len < extradata_size && extradata[j]==0xff; j++) {
                 header_len[i] += 0xff;
+                overall_len   += 0xff + 1;
             }
-            if (j >= extradata_size)
+            overall_len   += extradata[j];
+            if (overall_len > extradata_size)
                 return -1;
 
             header_len[i] += extradata[j];