summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authornicodvb <nicodvb@b3059339-0415-0410-9bf9-f77b7e298cf2>2005-05-13 00:00:54 +0000
committernicodvb <nicodvb@b3059339-0415-0410-9bf9-f77b7e298cf2>2005-05-13 00:00:54 +0000
commita2ac4cd2469a9c5568c1b53512aa2949ac3a3de7 (patch)
tree78b77e7220a6cb5a9f5c5e7916ff257929fcbd3f
parent4bd4a37a2eb8163b2af43ed0895e3baf0e117a4a (diff)
downloadmpv-a2ac4cd2469a9c5568c1b53512aa2949ac3a3de7.tar.bz2
mpv-a2ac4cd2469a9c5568c1b53512aa2949ac3a3de7.tar.xz
prevent possible exploit
git-svn-id: svn://svn.mplayerhq.hu/mplayer/trunk@15427 b3059339-0415-0410-9bf9-f77b7e298cf2
-rw-r--r--libmpdemux/demux_ogg.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/libmpdemux/demux_ogg.c b/libmpdemux/demux_ogg.c
index 27e56b7286..ab9e14418b 100644
--- a/libmpdemux/demux_ogg.c
+++ b/libmpdemux/demux_ogg.c
@@ -758,6 +758,7 @@ static void fixup_vorbis_wf(sh_audio_t *sh)
ogg_packet op[3];
unsigned char *buf[3];
unsigned char *ptr;
+ unsigned int len;
for(i = 0; i < 3; i++) {
op[i].bytes = ds_get_packet(sh->ds, &(op[i].packet));
@@ -772,7 +773,8 @@ static void fixup_vorbis_wf(sh_audio_t *sh)
memcpy(buf[i], op[i].packet, op[i].bytes);
}
- sh->wf = (WAVEFORMATEX*)calloc(1, sizeof(WAVEFORMATEX) + op[0].bytes + op[1].bytes + op[2].bytes + 64);
+ len = op[0].bytes + op[1].bytes + op[2].bytes;
+ sh->wf = (WAVEFORMATEX*)calloc(1, sizeof(WAVEFORMATEX) + len + len/255 + 64);
ptr = (unsigned char*) (sh->wf+1);
ptr[0] = 2;