diff options
author | rtogni <rtogni@b3059339-0415-0410-9bf9-f77b7e298cf2> | 2008-02-05 21:32:37 +0000 |
---|---|---|
committer | rtogni <rtogni@b3059339-0415-0410-9bf9-f77b7e298cf2> | 2008-02-05 21:32:37 +0000 |
commit | 74ab56cbac51df0c7777a5db3e4db845d061f27f (patch) | |
tree | a7d302698e48e4f1d40c8c09305d9f69f6833f1d | |
parent | 2e374b122beea9b7c1afbfc93405fef5f37da88c (diff) | |
download | mpv-74ab56cbac51df0c7777a5db3e4db845d061f27f.tar.bz2 mpv-74ab56cbac51df0c7777a5db3e4db845d061f27f.tar.xz |
Check buffer index while reading to avoid sig11
Fixes bugzilla #956
git-svn-id: svn://svn.mplayerhq.hu/mplayer/trunk@25957 b3059339-0415-0410-9bf9-f77b7e298cf2
-rw-r--r-- | libmpdemux/demux_asf.c | 27 |
1 files changed, 25 insertions, 2 deletions
diff --git a/libmpdemux/demux_asf.c b/libmpdemux/demux_asf.c index 5922765cc0..60697db84f 100644 --- a/libmpdemux/demux_asf.c +++ b/libmpdemux/demux_asf.c @@ -39,6 +39,16 @@ static inline unsigned read_varlen(uint8_t **ptr, int len, int def) { return def; } +/** + * \brief checks if there is enough data to read the bytes given by len + * \param ptr pointer to read from + * \param endptr pointer to the end of the buffer + * \param len lowest 2 bits indicate number of bytes to read + */ +static inline int check_varlen(uint8_t *ptr, uint8_t *endptr, int len) { + return len&3 ? ptr + (1<<(len&3 - 1)) - 1 < endptr : 1; +} + static void asf_descrambling(unsigned char **src,unsigned len, struct asf_priv* asf){ unsigned char *dst=malloc(len); unsigned char *s2=*src; @@ -334,6 +344,7 @@ static int demux_asf_fill_buffer(demuxer_t *demux, demux_stream_t *ds){ stream_read(demux->stream,asf->packet,asf->packetsize); if(demux->stream->eof) return 0; // EOF + if(asf->packetsize < 2) return 0; // Packet too short { unsigned char* p=asf->packet; @@ -352,7 +363,7 @@ static int demux_asf_fill_buffer(demuxer_t *demux, demux_stream_t *ds){ if( mp_msg_test(MSGT_DEMUX,MSGL_DBG2) ){ int i; - for(i=0;i<16;i++) printf(" %02X",asf->packet[i]); + for(i=0;i<FFMIN(16, asf->packetsize);i++) printf(" %02X",asf->packet[i]); printf("\n"); } @@ -362,6 +373,7 @@ static int demux_asf_fill_buffer(demuxer_t *demux, demux_stream_t *ds){ if (flags & 0x80) { p += (flags & 0x0f)+1; + if (p+1 >= p_end) return 0; // Packet too short flags = p[0]; segtype = p[1]; } @@ -371,12 +383,15 @@ static int demux_asf_fill_buffer(demuxer_t *demux, demux_stream_t *ds){ p+=2; // skip flags & segtype // Read packet size (plen): + if(!check_varlen(p, p_end, flags>> 5)) return 0; // Not enough data plen = read_varlen(&p, flags >> 5, 0); // Read sequence: + if(!check_varlen(p, p_end, flags>> 1)) return 0; // Not enough data sequence = read_varlen(&p, flags >> 1, 0); // Read padding size (padding): + if(!check_varlen(p, p_end, flags>> 3)) return 0; // Not enough data padding = read_varlen(&p, flags >> 3, 0); if(((flags>>5)&3)!=0){ @@ -389,12 +404,14 @@ static int demux_asf_fill_buffer(demuxer_t *demux, demux_stream_t *ds){ } // Read time & duration: + if (p+5 >= p_end) return 0; // Packet too short time = AV_RL32(p); p+=4; duration = AV_RL16(p); p+=2; // Read payload flags: if(flags&1){ // multiple sub-packets + if (p >= p_end) return 0; // Packet too short segsizetype=p[0]>>6; segs=p[0] & 0x3F; ++p; @@ -421,7 +438,7 @@ static int demux_asf_fill_buffer(demuxer_t *demux, demux_stream_t *ds){ if( mp_msg_test(MSGT_DEMUX,MSGL_DBG2) ){ int i; printf("seg %d:",seg); - for(i=0;i<16;i++) printf(" %02X",p[i]); + for(i=0;i<FFMIN(16, p_end - p);i++) printf(" %02X",p[i]); printf("\n"); } @@ -430,12 +447,15 @@ static int demux_asf_fill_buffer(demuxer_t *demux, demux_stream_t *ds){ p++; // Read media object number (seq): + if(!check_varlen(p, p_end, segtype >> 4)) break; // Not enough data seq = read_varlen(&p, segtype >> 4, 0); // Read offset or timestamp: + if(!check_varlen(p, p_end, segtype >> 2)) break; // Not enough data x = read_varlen(&p, segtype >> 2, 0); // Read replic.data len: + if(!check_varlen(p, p_end, segtype)) break; // Not enough data rlen = read_varlen(&p, segtype, 0); // printf("### rlen=%d \n",rlen); @@ -448,6 +468,7 @@ static int demux_asf_fill_buffer(demuxer_t *demux, demux_stream_t *ds){ default: if(rlen>=8){ p+=4; // skip object size + if (p+3 >= p_end) break; // Packet too short time2=AV_RL32(p); // read PTS if (asf->asf_is_dvr_ms) get_payload_extension_data(demux, &p, streamno, seq, &keyframe, &time2); @@ -461,6 +482,7 @@ static int demux_asf_fill_buffer(demuxer_t *demux, demux_stream_t *ds){ if(flags&1){ // multiple segments + if(!check_varlen(p, p_end, segsizetype)) break; // Not enough data len = read_varlen(&p, segsizetype, plen-(p-asf->packet)); } else { // single segment @@ -480,6 +502,7 @@ static int demux_asf_fill_buffer(demuxer_t *demux, demux_stream_t *ds){ int len2=p[0]; p++; //printf(" group part: %d bytes\n",len2); + if(len2 > len - 1) break; // Not enough data demux_asf_read_packet(demux,p,len2,streamno,seq,x,duration,-1,keyframe); p+=len2; len-=len2+1; |