diff options
| author | iive <iive@b3059339-0415-0410-9bf9-f77b7e298cf2> | 2006-03-30 23:06:18 +0000 |
|---|---|---|
| committer | iive <iive@b3059339-0415-0410-9bf9-f77b7e298cf2> | 2006-03-30 23:06:18 +0000 |
| commit | 9b4c7840b908da645e1856de29a006cc168b79a8 (patch) | |
| tree | 7f546f560e649e0638147727fefa769eed0823e5 /libmpdemux | |
| parent | a703fdaa614d54076121fa176b54eeee3be7e433 (diff) | |
| download | mpv-9b4c7840b908da645e1856de29a006cc168b79a8.tar.bz2 mpv-9b4c7840b908da645e1856de29a006cc168b79a8.tar.xz | |
fix descrambling of asf file,
where signed buffer could cause erroneous values to be filled in descrable variables,
add misssing check for one of these variables
and restore sign of these variables as insurance that these checks will work even in such case.
git-svn-id: svn://svn.mplayerhq.hu/mplayer/trunk@18002 b3059339-0415-0410-9bf9-f77b7e298cf2
Diffstat (limited to 'libmpdemux')
| -rw-r--r-- | libmpdemux/asf.h | 6 | ||||
| -rw-r--r-- | libmpdemux/asfheader.c | 6 | ||||
| -rw-r--r-- | libmpdemux/demux_asf.c | 2 |
3 files changed, 8 insertions, 6 deletions
diff --git a/libmpdemux/asf.h b/libmpdemux/asf.h index 543e1832ee..19c588556c 100644 --- a/libmpdemux/asf.h +++ b/libmpdemux/asf.h @@ -216,9 +216,9 @@ typedef struct { struct asf_priv { ASF_header_t header; unsigned char* packet; - unsigned scrambling_h; - unsigned scrambling_w; - unsigned scrambling_b; + int scrambling_h; + int scrambling_w; + int scrambling_b; unsigned packetsize; double packetrate; unsigned movielength; diff --git a/libmpdemux/asfheader.c b/libmpdemux/asfheader.c index a2edbfcd63..29561da6be 100644 --- a/libmpdemux/asfheader.c +++ b/libmpdemux/asfheader.c @@ -184,7 +184,7 @@ int read_asf_header(demuxer_t *demuxer,struct asf_priv* asf){ while ((pos = find_asf_guid(hdr, asf_stream_header_guid, pos, hdr_len)) >= 0) { ASF_stream_header_t *streamh = (ASF_stream_header_t *)&hdr[pos]; - char *buffer; + uint8_t *buffer; pos += sizeof(ASF_stream_header_t); if (pos > hdr_len) goto len_err_out; le2me_ASF_stream_header_t(streamh); @@ -217,7 +217,9 @@ int read_asf_header(demuxer_t *demuxer,struct asf_priv* asf){ asf->scrambling_h=buffer[0]; asf->scrambling_w=(buffer[2]<<8)|buffer[1]; asf->scrambling_b=(buffer[4]<<8)|buffer[3]; - asf->scrambling_w/=asf->scrambling_b; + if(asf->scrambling_b>0){ + asf->scrambling_w/=asf->scrambling_b; + } } else { asf->scrambling_b=asf->scrambling_h=asf->scrambling_w=1; } diff --git a/libmpdemux/demux_asf.c b/libmpdemux/demux_asf.c index e75de3cd23..c473caae3a 100644 --- a/libmpdemux/demux_asf.c +++ b/libmpdemux/demux_asf.c @@ -100,7 +100,7 @@ static int demux_asf_read_packet(demuxer_t *demux,unsigned char *data,int len,in if(ds->asf_seq!=seq){ // closed segment, finalize packet: if(ds==demux->audio) - if(asf->scrambling_h>1 && asf->scrambling_w>1) + if(asf->scrambling_h>1 && asf->scrambling_w>1 && asf->scrambling_b>0) asf_descrambling(&ds->asf_packet->buffer,ds->asf_packet->len,asf); ds_add_packet(ds,ds->asf_packet); ds->asf_packet=NULL; |