diff options
| author | nicodvb <nicodvb@b3059339-0415-0410-9bf9-f77b7e298cf2> | 2005-05-13 00:00:54 +0000 |
|---|---|---|
| committer | nicodvb <nicodvb@b3059339-0415-0410-9bf9-f77b7e298cf2> | 2005-05-13 00:00:54 +0000 |
| commit | a2ac4cd2469a9c5568c1b53512aa2949ac3a3de7 (patch) | |
| tree | 78b77e7220a6cb5a9f5c5e7916ff257929fcbd3f /libmpdemux/demux_ogg.c | |
| parent | 4bd4a37a2eb8163b2af43ed0895e3baf0e117a4a (diff) | |
| download | mpv-a2ac4cd2469a9c5568c1b53512aa2949ac3a3de7.tar.bz2 mpv-a2ac4cd2469a9c5568c1b53512aa2949ac3a3de7.tar.xz | |
prevent possible exploit
git-svn-id: svn://svn.mplayerhq.hu/mplayer/trunk@15427 b3059339-0415-0410-9bf9-f77b7e298cf2
Diffstat (limited to 'libmpdemux/demux_ogg.c')
| -rw-r--r-- | libmpdemux/demux_ogg.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/libmpdemux/demux_ogg.c b/libmpdemux/demux_ogg.c index 27e56b7286..ab9e14418b 100644 --- a/libmpdemux/demux_ogg.c +++ b/libmpdemux/demux_ogg.c @@ -758,6 +758,7 @@ static void fixup_vorbis_wf(sh_audio_t *sh) ogg_packet op[3]; unsigned char *buf[3]; unsigned char *ptr; + unsigned int len; for(i = 0; i < 3; i++) { op[i].bytes = ds_get_packet(sh->ds, &(op[i].packet)); @@ -772,7 +773,8 @@ static void fixup_vorbis_wf(sh_audio_t *sh) memcpy(buf[i], op[i].packet, op[i].bytes); } - sh->wf = (WAVEFORMATEX*)calloc(1, sizeof(WAVEFORMATEX) + op[0].bytes + op[1].bytes + op[2].bytes + 64); + len = op[0].bytes + op[1].bytes + op[2].bytes; + sh->wf = (WAVEFORMATEX*)calloc(1, sizeof(WAVEFORMATEX) + len + len/255 + 64); ptr = (unsigned char*) (sh->wf+1); ptr[0] = 2; |