diff options
| author |  reimar <reimar@b3059339-0415-0410-9bf9-f77b7e298cf2> | 2008-09-30 10:44:50 +0000 |
|---|---|---|
| committer | reimar <reimar@b3059339-0415-0410-9bf9-f77b7e298cf2> | 2008-09-30 10:44:50 +0000 |
| commit | 0651813cb00fb1246e7f5025714dce3088af4f64 (patch) | |
| tree | f3d7c442257a07478da4c5fe8c7acbd41fb81223 /libmpdemux | |
| parent | f938a38b72cab1f5f1fe4585593a1b3851f9f06b (diff) | |
Apply patch for oCERT #2008-013 / CVE-2008-3827
git-svn-id: svn://svn.mplayerhq.hu/mplayer/trunk@27675 b3059339-0415-0410-9bf9-f77b7e298cf2
Diffstat (limited to 'libmpdemux')
| -rw-r--r-- | libmpdemux/demux_real.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/libmpdemux/demux_real.c b/libmpdemux/demux_real.c index 7de8611ec0..88e6574d6e 100644 --- a/libmpdemux/demux_real.c +++ b/libmpdemux/demux_real.c @@ -947,6 +947,7 @@ got_video: // last fragment! if(dp_hdr->len!=vpkg_length-vpkg_offset) mp_msg(MSGT_DEMUX,MSGL_V,"warning! assembled.len=%d frag.len=%d total.len=%d \n",dp->len,vpkg_offset,vpkg_length-vpkg_offset); + if (vpkg_offset > dp->len - sizeof(dp_hdr_t) - dp_hdr->len) vpkg_offset = dp->len - sizeof(dp_hdr_t) - dp_hdr->len; stream_read(demuxer->stream, dp_data+dp_hdr->len, vpkg_offset); if((dp_data[dp_hdr->len]&0x20) && (sh_video->format==0x30335652)) --dp_hdr->chunks; else dp_hdr->len+=vpkg_offset; @@ -970,6 +971,7 @@ got_video: // non-last fragment: if(dp_hdr->len!=vpkg_offset) mp_msg(MSGT_DEMUX,MSGL_V,"warning! assembled.len=%d offset=%d frag.len=%d total.len=%d \n",dp->len,vpkg_offset,len,vpkg_length); + if (len > dp->len - sizeof(dp_hdr_t) - dp_hdr->len) len = dp->len - sizeof(dp_hdr_t) - dp_hdr->len; stream_read(demuxer->stream, dp_data+dp_hdr->len, len); if((dp_data[dp_hdr->len]&0x20) && (sh_video->format==0x30335652)) --dp_hdr->chunks; else dp_hdr->len+=len; @@ -992,6 +994,7 @@ got_video: extra[0]=1; extra[1]=0; // offset of the first chunk if(0x00==(vpkg_header&0xc0)){ // first fragment: + if (len > dp->len - sizeof(dp_hdr_t)) len = dp->len - sizeof(dp_hdr_t); dp_hdr->len=len; stream_read(demuxer->stream, dp_data, len); ds->asf_packet=dp; |