diff options
| author | Ronald S. Bultje <rsbultje@gmail.com> | 2012-03-02 05:01:22 +0400 |
|---|---|---|
| committer | Reinhard Tartler <siretart@tauware.de> | 2012-04-01 20:33:27 +0400 |
| commit | 433aaeb2f1cf679f254f5f1c7220b4100bc89c68 (patch) | |
| tree | 4a07c343f17d63ee4da256c3d80ce0d8f9ad854a /libavformat/matroskadec.c | |
| parent | 88b47010c4e2ed0d756f30c54b0d88153c33aec5 (diff) | |
matroska: check buffer size for RM-style byte reordering.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 9c239f6026a170866a4a0c96908980ac2cfaa8b3)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
Diffstat (limited to 'libavformat/matroskadec.c')
| -rw-r--r-- | libavformat/matroskadec.c | 22 |
1 files changed, 19 insertions, 3 deletions
diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c index f74d028923..a70f2ef86a 100644 --- a/libavformat/matroskadec.c +++ b/libavformat/matroskadec.c @@ -1775,15 +1775,31 @@ static int matroska_parse_block(MatroskaDemuxContext *matroska, uint8_t *data, if (!track->audio.pkt_cnt) { if (track->audio.sub_packet_cnt == 0) track->audio.buf_timecode = timecode; - if (st->codec->codec_id == CODEC_ID_RA_288) + if (st->codec->codec_id == CODEC_ID_RA_288) { + if (size < cfs * h / 2) { + av_log(matroska->ctx, AV_LOG_ERROR, + "Corrupt int4 RM-style audio packet size\n"); + return AVERROR_INVALIDDATA; + } for (x=0; x<h/2; x++) memcpy(track->audio.buf+x*2*w+y*cfs, data+x*cfs, cfs); - else if (st->codec->codec_id == CODEC_ID_SIPR) + } else if (st->codec->codec_id == CODEC_ID_SIPR) { + if (size < w) { + av_log(matroska->ctx, AV_LOG_ERROR, + "Corrupt sipr RM-style audio packet size\n"); + return AVERROR_INVALIDDATA; + } memcpy(track->audio.buf + y*w, data, w); - else + } else { + if (size < sps * w / sps) { + av_log(matroska->ctx, AV_LOG_ERROR, + "Corrupt generic RM-style audio packet size\n"); + return AVERROR_INVALIDDATA; + } for (x=0; x<w/sps; x++) memcpy(track->audio.buf+sps*(h*x+((h+1)/2)*(y&1)+(y>>1)), data+x*sps, sps); + } if (++track->audio.sub_packet_cnt >= h) { if (st->codec->codec_id == CODEC_ID_SIPR) |