highperfocused/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

matroskadec: fix integer underflow if header length < probe length.

Browse Source 
This fixes a crash with specifically crafted files.

Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>
(cherry picked from commit 69619a13c3fef940cba545cf0a283ff22771dd71)
This commit is contained in:
Chris Evans 2011-07-19 17:51:48 -07:00 committed by Reinhard Tartler
parent 20829cf8a2
commit 5fab0ccd81
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
libavformat/matroskadec.c
View File

@ -900,6 +900,8 @@ static int matroska_probe(AVProbeData *p)
* Not fully fool-proof, but good enough. */
for (i = 0; i < FF_ARRAY_ELEMS(matroska_doctypes); i++) {
int probelen = strlen(matroska_doctypes[i]);
if (total < probelen)
continue;
for (n = 4+size; n <= 4+size+total-probelen; n++)
if (!memcmp(p->buf+n, matroska_doctypes[i], probelen))
return AVPROBE_SCORE_MAX;