videolan
/
ffmpeg
mirror of https://git.videolan.org/git/ffmpeg.git
1
Fork 0
Code Releases Activity

matroska: Update the available size after lace parsing 

Fix heap-buffer-overflow in matroska_parse_block for
corrupted real media in mkv files.

CC: libav-stable@libav.org

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
This commit is contained in:
Dale Curtis 2013-03-27 14:02:03 -07:00 committed by Luca Barbato
parent 19f251a288
commit fc43c19a56
1 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
libavformat/matroskadec.c
View File

@ -1756,10 +1756,10 @@ static void matroska_clear_queue(MatroskaDemuxContext *matroska)
}
static int matroska_parse_laces(MatroskaDemuxContext *matroska, uint8_t **buf,
int size, int type,
int* buf_size, int type,
uint32_t **lace_buf, int *laces)
{
int res = 0, n;
int res = 0, n, size = *buf_size;
uint8_t *data = *buf;
uint32_t *lace_size;
@ -1857,6 +1857,7 @@ static int matroska_parse_laces(MatroskaDemuxContext *matroska, uint8_t **buf,
*buf = data;
*lace_buf = lace_size;
*buf_size = size;
return res;
}
@ -2051,7 +2052,7 @@ static int matroska_parse_block(MatroskaDemuxContext *matroska, uint8_t *data,
matroska->skip_to_keyframe = 0;
}
res = matroska_parse_laces(matroska, &data, size, (flags & 0x06) >> 1,
res = matroska_parse_laces(matroska, &data, &size, (flags & 0x06) >> 1,
&lace_size, &laces);
if (res)