Browse Source

matroskadec: fix integer underflow if header length < probe length.

This fixes a crash with specifically crafted files.

Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>
tags/n0.9
Chris Evans Ronald S. Bultje 14 years ago
parent
commit
69619a13c3
1 changed files with 2 additions and 0 deletions
  1. +2
    -0
      libavformat/matroskadec.c

+ 2
- 0
libavformat/matroskadec.c View File

@@ -903,6 +903,8 @@ static int matroska_probe(AVProbeData *p)
* Not fully fool-proof, but good enough. */
for (i = 0; i < FF_ARRAY_ELEMS(matroska_doctypes); i++) {
int probelen = strlen(matroska_doctypes[i]);
if (total < probelen)
continue;
for (n = 4+size; n <= 4+size+total-probelen; n++)
if (!memcmp(p->buf+n, matroska_doctypes[i], probelen))
return AVPROBE_SCORE_MAX;


Loading…
Cancel
Save