aboutsummaryrefslogtreecommitdiffhomepage
diff options
context:
space:
mode:
authorGravatar iive <iive@b3059339-0415-0410-9bf9-f77b7e298cf2>2006-03-30 23:06:18 +0000
committerGravatar iive <iive@b3059339-0415-0410-9bf9-f77b7e298cf2>2006-03-30 23:06:18 +0000
commit9b4c7840b908da645e1856de29a006cc168b79a8 (patch)
tree7f546f560e649e0638147727fefa769eed0823e5
parenta703fdaa614d54076121fa176b54eeee3be7e433 (diff)
fix descrambling of asf file,
where signed buffer could cause erroneous values to be filled in descrable variables, add misssing check for one of these variables and restore sign of these variables as insurance that these checks will work even in such case. git-svn-id: svn://svn.mplayerhq.hu/mplayer/trunk@18002 b3059339-0415-0410-9bf9-f77b7e298cf2
-rw-r--r--libmpdemux/asf.h6
-rw-r--r--libmpdemux/asfheader.c6
-rw-r--r--libmpdemux/demux_asf.c2
3 files changed, 8 insertions, 6 deletions
diff --git a/libmpdemux/asf.h b/libmpdemux/asf.h
index 543e1832ee..19c588556c 100644
--- a/libmpdemux/asf.h
+++ b/libmpdemux/asf.h
@@ -216,9 +216,9 @@ typedef struct {
struct asf_priv {
ASF_header_t header;
unsigned char* packet;
- unsigned scrambling_h;
- unsigned scrambling_w;
- unsigned scrambling_b;
+ int scrambling_h;
+ int scrambling_w;
+ int scrambling_b;
unsigned packetsize;
double packetrate;
unsigned movielength;
diff --git a/libmpdemux/asfheader.c b/libmpdemux/asfheader.c
index a2edbfcd63..29561da6be 100644
--- a/libmpdemux/asfheader.c
+++ b/libmpdemux/asfheader.c
@@ -184,7 +184,7 @@ int read_asf_header(demuxer_t *demuxer,struct asf_priv* asf){
while ((pos = find_asf_guid(hdr, asf_stream_header_guid, pos, hdr_len)) >= 0)
{
ASF_stream_header_t *streamh = (ASF_stream_header_t *)&hdr[pos];
- char *buffer;
+ uint8_t *buffer;
pos += sizeof(ASF_stream_header_t);
if (pos > hdr_len) goto len_err_out;
le2me_ASF_stream_header_t(streamh);
@@ -217,7 +217,9 @@ int read_asf_header(demuxer_t *demuxer,struct asf_priv* asf){
asf->scrambling_h=buffer[0];
asf->scrambling_w=(buffer[2]<<8)|buffer[1];
asf->scrambling_b=(buffer[4]<<8)|buffer[3];
- asf->scrambling_w/=asf->scrambling_b;
+ if(asf->scrambling_b>0){
+ asf->scrambling_w/=asf->scrambling_b;
+ }
} else {
asf->scrambling_b=asf->scrambling_h=asf->scrambling_w=1;
}
diff --git a/libmpdemux/demux_asf.c b/libmpdemux/demux_asf.c
index e75de3cd23..c473caae3a 100644
--- a/libmpdemux/demux_asf.c
+++ b/libmpdemux/demux_asf.c
@@ -100,7 +100,7 @@ static int demux_asf_read_packet(demuxer_t *demux,unsigned char *data,int len,in
if(ds->asf_seq!=seq){
// closed segment, finalize packet:
if(ds==demux->audio)
- if(asf->scrambling_h>1 && asf->scrambling_w>1)
+ if(asf->scrambling_h>1 && asf->scrambling_w>1 && asf->scrambling_b>0)
asf_descrambling(&ds->asf_packet->buffer,ds->asf_packet->len,asf);
ds_add_packet(ds,ds->asf_packet);
ds->asf_packet=NULL;