RepoMirrors/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2025-01-02 04:52:09 +00:00
Code Issues Projects Releases Wiki Activity

fix buffer overread with invalid Vorbis header

Browse Source 
Originally committed as revision 10705 to svn://svn.ffmpeg.org/ffmpeg/trunk
This commit is contained in:
Måns Rullgård 2007-10-10 22:59:31 +00:00
parent 62f2c069b8
commit f5475e1b38
1 changed files with 13 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
libavformat/oggparsevorbis.c
View File

@ -32,17 +32,17 @@
extern int extern int
vorbis_comment(AVFormatContext * as, uint8_t *buf, int size) vorbis_comment(AVFormatContext * as, uint8_t *buf, int size)
{ {
char *p = buf; uint8_t *p = buf;
int s, n, j; unsigned s, n, j;
if (size < 4) if (size < 8) /* must have vendor_length and user_comment_list_length */
return -1; return -1;
s = AV_RL32(p); s = AV_RL32(p);
p += 4; p += 4;
size -= 4; size -= 4;
if (size < s + 4) if (size - 4 < s)
return -1; return -1;
p += s; p += s;
@ -174,12 +174,19 @@ vorbis_header (AVFormatContext * s, int idx)
return 0; return 0;
} }
if (os->psize < 1)
return -1;
priv = os->private; priv = os->private;
priv->len[os->seq] = os->psize; priv->len[os->seq] = os->psize;
priv->packet[os->seq] = av_mallocz(os->psize); priv->packet[os->seq] = av_mallocz(os->psize);
memcpy(priv->packet[os->seq], os->buf + os->pstart, os->psize); memcpy(priv->packet[os->seq], os->buf + os->pstart, os->psize);
if (os->buf[os->pstart] == 1) { if (os->buf[os->pstart] == 1) {
uint8_t *p = os->buf + os->pstart + 11; //skip up to the audio channels uint8_t *p = os->buf + os->pstart + 11; //skip up to the audio channels
if (os->psize != 30)
return -1;
st->codec->channels = *p++; st->codec->channels = *p++;
st->codec->sample_rate = AV_RL32(p); st->codec->sample_rate = AV_RL32(p);
p += 8; //skip maximum and and nominal bitrate p += 8; //skip maximum and and nominal bitrate
@ -191,7 +198,8 @@ vorbis_header (AVFormatContext * s, int idx)
st->time_base.num = 1; st->time_base.num = 1;
st->time_base.den = st->codec->sample_rate; st->time_base.den = st->codec->sample_rate;
} else if (os->buf[os->pstart] == 3) { } else if (os->buf[os->pstart] == 3) {
vorbis_comment (s, os->buf + os->pstart + 7, os->psize - 8); if (os->psize > 8)
vorbis_comment (s, os->buf + os->pstart + 7, os->psize - 8);
} else { } else {
st->codec->extradata_size = st->codec->extradata_size =
fixup_vorbis_headers(s, priv, &st->codec->extradata); fixup_vorbis_headers(s, priv, &st->codec->extradata);