Module: libav Branch: release/0.7 Commit: 5fab0ccd81df0bc3fd6d16756006c260fdbca6e7
Author: Chris Evans <[email protected]> Committer: Reinhard Tartler <[email protected]> Date: Tue Jul 19 17:51:48 2011 -0700 matroskadec: fix integer underflow if header length < probe length. This fixes a crash with specifically crafted files. Signed-off-by: Ronald S. Bultje <[email protected]> (cherry picked from commit 69619a13c3fef940cba545cf0a283ff22771dd71) --- libavformat/matroskadec.c | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-) diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c index 60f6c69..f74f76c 100644 --- a/libavformat/matroskadec.c +++ b/libavformat/matroskadec.c @@ -900,6 +900,8 @@ static int matroska_probe(AVProbeData *p) * Not fully fool-proof, but good enough. */ for (i = 0; i < FF_ARRAY_ELEMS(matroska_doctypes); i++) { int probelen = strlen(matroska_doctypes[i]); + if (total < probelen) + continue; for (n = 4+size; n <= 4+size+total-probelen; n++) if (!memcmp(p->buf+n, matroska_doctypes[i], probelen)) return AVPROBE_SCORE_MAX; _______________________________________________ libav-commits mailing list [email protected] https://lists.libav.org/mailman/listinfo/libav-commits
