RepoMirrors
/
mpv
mirror of https://github.com/mpv-player/mpv
1
0
Fork 0
Code Issues Releases Wiki Activity

demux_asf: add sanity check 

Check that rlen is valid before using it to increment a pointer.

git-svn-id: svn://svn.mplayerhq.hu/mplayer/trunk@32832 b3059339-0415-0410-9bf9-f77b7e298cf2
This commit is contained in:
reimar 2011-01-30 10:38:10 +00:00 committed by Uoti Urpala
parent 179cb785e9
commit 851bb3ce82
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
libmpdemux/demux_asf.c
View File

@ -468,6 +468,10 @@ static int demux_asf_fill_buffer(demuxer_t *demux, demux_stream_t *ds){
rlen = read_varlen(&p, segtype, 0);
// printf("### rlen=%d \n",rlen);
if (rlen < 0 || rlen > p_end - p) {
mp_msg(MSGT_DEMUX, MSGL_V, "invalid rlen=%d\n", rlen);
break;
}
switch(rlen){
case 0x01: // 1 = special, means grouping