RepoMirrors
/
mpv
mirror of https://github.com/mpv-player/mpv
1
0
Fork 0
Code Issues Releases Wiki Activity

fix descrambling of asf file, 

where signed buffer could cause erroneous values to be filled in descrable variables,
add misssing check for one of these variables
and restore sign of these variables as insurance that these checks will work even in such case.


git-svn-id: svn://svn.mplayerhq.hu/mplayer/trunk@18002 b3059339-0415-0410-9bf9-f77b7e298cf2
This commit is contained in:
iive 2006-03-30 23:06:18 +00:00
parent a703fdaa61
commit 9b4c7840b9
3 changed files with 8 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
libmpdemux/asf.h
View File

@ -216,9 +216,9 @@ typedef struct {
struct asf_priv {
ASF_header_t header;
unsigned char* packet;
unsigned scrambling_h;
unsigned scrambling_w;
unsigned scrambling_b;
int scrambling_h;
int scrambling_w;
int scrambling_b;
unsigned packetsize;
double packetrate;
unsigned movielength;

6
libmpdemux/asfheader.c
View File

@ -184,7 +184,7 @@ int read_asf_header(demuxer_t *demuxer,struct asf_priv* asf){
while ((pos = find_asf_guid(hdr, asf_stream_header_guid, pos, hdr_len)) >= 0)
{
ASF_stream_header_t *streamh = (ASF_stream_header_t *)&hdr[pos];
char *buffer;
uint8_t *buffer;
pos += sizeof(ASF_stream_header_t);
if (pos > hdr_len) goto len_err_out;
le2me_ASF_stream_header_t(streamh);
@ -217,7 +217,9 @@ int read_asf_header(demuxer_t *demuxer,struct asf_priv* asf){
asf->scrambling_h=buffer[0];
asf->scrambling_w=(buffer[2]<<8)|buffer[1];
asf->scrambling_b=(buffer[4]<<8)|buffer[3];
asf->scrambling_w/=asf->scrambling_b;
if(asf->scrambling_b>0){
asf->scrambling_w/=asf->scrambling_b;
}
} else {
asf->scrambling_b=asf->scrambling_h=asf->scrambling_w=1;
}

2
libmpdemux/demux_asf.c
View File

@ -100,7 +100,7 @@ static int demux_asf_read_packet(demuxer_t *demux,unsigned char *data,int len,in
if(ds->asf_seq!=seq){
// closed segment, finalize packet:
if(ds==demux->audio)
if(asf->scrambling_h>1 && asf->scrambling_w>1)
if(asf->scrambling_h>1 && asf->scrambling_w>1 && asf->scrambling_b>0)
asf_descrambling(&ds->asf_packet->buffer,ds->asf_packet->len,asf);
ds_add_packet(ds,ds->asf_packet);
ds->asf_packet=NULL;