On 2012-09-19 20:15:59 +0200, Luca Barbato wrote:
> Stricter validation, explicitly exit on misparsing and some error
> forwarding from the ebml parsing functions used.
> ---
>
> This time even checking for rounding error in the division.
>
> libavformat/matroskadec.c | 23 ++++++++++++++++-------
> 1 files changed, 16 insertions(+), 7 deletions(-)
>
> diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c
> index 27c962e..ff2a6c2 100644
> --- a/libavformat/matroskadec.c
> +++ b/libavformat/matroskadec.c
> @@ -1829,11 +1829,19 @@ static int matroska_parse_block(MatroskaDemuxContext
> *matroska, uint8_t *data,
> }
> total += lace_size[n];
> }
> + if (size <= total) {
> + res = AVERROR_INVALIDDATA;
> + goto end;
> + }
> lace_size[n] = size - total;
> break;
> }
>
> case 0x2: /* fixed-size lacing */
> + if (size != (size / laces) * size) {
This looks wrong, it's equivalent to (size != laces) which doesn't make
much sense.
Janne
_______________________________________________
libav-devel mailing list
[email protected]
https://lists.libav.org/mailman/listinfo/libav-devel
