Module: libav Branch: master Commit: 69619a13c3fef940cba545cf0a283ff22771dd71
Author: Chris Evans <[email protected]> Committer: Ronald S. Bultje <[email protected]> Date: Tue Jul 19 17:51:48 2011 -0700 matroskadec: fix integer underflow if header length < probe length. This fixes a crash with specifically crafted files. Signed-off-by: Ronald S. Bultje <[email protected]> --- libavformat/matroskadec.c | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-) diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c index 852760c..0379977 100644 --- a/libavformat/matroskadec.c +++ b/libavformat/matroskadec.c @@ -903,6 +903,8 @@ static int matroska_probe(AVProbeData *p) * Not fully fool-proof, but good enough. */ for (i = 0; i < FF_ARRAY_ELEMS(matroska_doctypes); i++) { int probelen = strlen(matroska_doctypes[i]); + if (total < probelen) + continue; for (n = 4+size; n <= 4+size+total-probelen; n++) if (!memcmp(p->buf+n, matroska_doctypes[i], probelen)) return AVPROBE_SCORE_MAX; _______________________________________________ libav-commits mailing list [email protected] https://lists.libav.org/mailman/listinfo/libav-commits
