diff options
author | reimar <reimar@b3059339-0415-0410-9bf9-f77b7e298cf2> | 2006-04-11 10:43:20 +0000 |
---|---|---|
committer | reimar <reimar@b3059339-0415-0410-9bf9-f77b7e298cf2> | 2006-04-11 10:43:20 +0000 |
commit | b72ebc6fb8bc52666cb40bdbb38478466628df48 (patch) | |
tree | 2e3ccabac10782ef39e842127b8e74933c4afc06 /libmpdemux/demux_audio.c | |
parent | 5f65c05e35bdf4db0214325676c9325662bc8137 (diff) | |
download | mpv-b72ebc6fb8bc52666cb40bdbb38478466628df48.tar.bz2 mpv-b72ebc6fb8bc52666cb40bdbb38478466628df48.tar.xz |
check wav header length against upper limit, should protect against
some misdetections (esp. with text files).
git-svn-id: svn://svn.mplayerhq.hu/mplayer/trunk@18075 b3059339-0415-0410-9bf9-f77b7e298cf2
Diffstat (limited to 'libmpdemux/demux_audio.c')
-rw-r--r-- | libmpdemux/demux_audio.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/libmpdemux/demux_audio.c b/libmpdemux/demux_audio.c index e6457228b7..de9dd87bd9 100644 --- a/libmpdemux/demux_audio.c +++ b/libmpdemux/demux_audio.c @@ -27,6 +27,9 @@ typedef struct da_priv { float last_pts; } da_priv_t; +//! rather arbitrary value for maximum length of wav-format headers +#define MAX_WAVHDR_LEN (1 * 1024 * 1024) + // how many valid frames in a row we need before accepting as valid MP3 #define MIN_MP3_HDRS 5 @@ -412,6 +415,11 @@ static int demux_audio_open(demuxer_t* demuxer) { free_sh_audio(sh_audio); return 0; } + if(l > MAX_WAVHDR_LEN) { + mp_msg(MSGT_DEMUX,MSGL_ERR,"[demux_audio] Bad wav header length: too long (%d)!!!\n",l); + free_sh_audio(sh_audio); + return 0; + } sh_audio->wf = w = (WAVEFORMATEX*)malloc(l > sizeof(WAVEFORMATEX) ? l : sizeof(WAVEFORMATEX)); w->wFormatTag = sh_audio->format = stream_read_word_le(s); w->nChannels = sh_audio->channels = stream_read_word_le(s); |