From 4a46fcaebcf97243a5f7a24320e1871e57f2a948 Mon Sep 17 00:00:00 2001 From: reimar Date: Wed, 16 Jul 2008 16:43:40 +0000 Subject: Make sure demuxed ASF packet is properly padded after descrambling git-svn-id: svn://svn.mplayerhq.hu/mplayer/trunk@27302 b3059339-0415-0410-9bf9-f77b7e298cf2 --- libmpdemux/demux_asf.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'libmpdemux/demux_asf.c') diff --git a/libmpdemux/demux_asf.c b/libmpdemux/demux_asf.c index d007ae1a3e..8f370c6d31 100644 --- a/libmpdemux/demux_asf.c +++ b/libmpdemux/demux_asf.c @@ -50,9 +50,12 @@ static inline int check_varlen(uint8_t *ptr, uint8_t *endptr, int len) { } static void asf_descrambling(unsigned char **src,unsigned len, struct asf_priv* asf){ - unsigned char *dst=malloc(len); + unsigned char *dst; unsigned char *s2=*src; unsigned i=0,x,y; + if (len > UINT_MAX - FF_INPUT_BUFFER_PADDING_SIZE) + return; + dst = malloc(len + FF_INPUT_BUFFER_PADDING_SIZE); while(len>=asf->scrambling_h*asf->scrambling_w*asf->scrambling_b+i){ // mp_msg(MSGT_DEMUX,MSGL_DBG4,"descrambling! (w=%d b=%d)\n",w,asf_scrambling_b); //i+=asf_scrambling_h*asf_scrambling_w; -- cgit v1.2.3