diff options
| author |  reimar <reimar@b3059339-0415-0410-9bf9-f77b7e298cf2> | 2007-12-21 11:34:04 +0000 |
|---|---|---|
| committer | reimar <reimar@b3059339-0415-0410-9bf9-f77b7e298cf2> | 2007-12-21 11:34:04 +0000 |
| commit | 5947ca8334f207eb43ef115acb895ecda9b28b2b (patch) | |
| tree | a058dfd874b610b7e59c718a75ec17d28f1f43a0 | |
| parent | f00272efea5dddf6c31c7183dbe47586358644a8 (diff) | |
100l, buffer bound checks work better when done _before_ access.
git-svn-id: svn://svn.mplayerhq.hu/mplayer/trunk@25481 b3059339-0415-0410-9bf9-f77b7e298cf2
| -rw-r--r-- | stream/asf_streaming.c | 5 |
1 files changed, 2 insertions, 3 deletions
diff --git a/stream/asf_streaming.c b/stream/asf_streaming.c index df5ad2d27a..21e68ccfec 100644 --- a/stream/asf_streaming.c +++ b/stream/asf_streaming.c @@ -310,21 +310,20 @@ static int asf_streaming_parse_header(int fd, streaming_ctrl_t* streaming_ctrl) char *end = &buffer[size]; mp_msg(MSGT_NETWORK, MSGL_V, "Stream bitrate properties object\n"); + if (ptr + 2 > end) goto len_err_out; stream_count = AV_RL16(ptr); ptr += 2; - if (ptr > end) goto len_err_out; mp_msg(MSGT_NETWORK, MSGL_V, " stream count=[0x%x][%u]\n", stream_count, stream_count ); for( i=0 ; i<stream_count ; i++ ) { uint32_t rate; int id; int j; + if (ptr + 6 > end) goto len_err_out; id = AV_RL16(ptr); ptr += 2; - if (ptr > end) goto len_err_out; rate = AV_RL32(ptr); ptr += 4; - if (ptr > end) goto len_err_out; mp_msg(MSGT_NETWORK, MSGL_V, " stream id=[0x%x][%u]\n", id, id); mp_msg(MSGT_NETWORK, MSGL_V, |