RepoMirrors/mpv
1
0
Fork 0
mirror of https://github.com/mpv-player/mpv synced 2025-01-02 04:42:10 +00:00
Code Issues Releases Wiki Activity

check wav header length against upper limit, should protect against

Browse Source 
some misdetections (esp. with text files).


git-svn-id: svn://svn.mplayerhq.hu/mplayer/trunk@18075 b3059339-0415-0410-9bf9-f77b7e298cf2
This commit is contained in:
reimar 2006-04-11 10:43:20 +00:00
parent 5f65c05e35
commit b72ebc6fb8
1 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
libmpdemux/demux_audio.c
View File

@ -27,6 +27,9 @@ typedef struct da_priv {
float last_pts;
} da_priv_t;
//! rather arbitrary value for maximum length of wav-format headers
#define MAX_WAVHDR_LEN (1 * 1024 * 1024)
// how many valid frames in a row we need before accepting as valid MP3
#define MIN_MP3_HDRS 5
@ -412,6 +415,11 @@ static int demux_audio_open(demuxer_t* demuxer) {
free_sh_audio(sh_audio);
return 0;
}
if(l > MAX_WAVHDR_LEN) {
mp_msg(MSGT_DEMUX,MSGL_ERR,"[demux_audio] Bad wav header length: too long (%d)!!!\n",l);
free_sh_audio(sh_audio);
return 0;
}
sh_audio->wf = w = (WAVEFORMATEX*)malloc(l > sizeof(WAVEFORMATEX) ? l : sizeof(WAVEFORMATEX));
w->wFormatTag = sh_audio->format = stream_read_word_le(s);
w->nChannels = sh_audio->channels = stream_read_word_le(s);