Janne Grunau <[email protected]> writes: > On 2012-09-19 20:15:59 +0200, Luca Barbato wrote: >> Stricter validation, explicitly exit on misparsing and some error >> forwarding from the ebml parsing functions used. >> --- >> >> This time even checking for rounding error in the division. >> >> libavformat/matroskadec.c | 23 ++++++++++++++++------- >> 1 files changed, 16 insertions(+), 7 deletions(-) >> >> diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c >> index 27c962e..ff2a6c2 100644 >> --- a/libavformat/matroskadec.c >> +++ b/libavformat/matroskadec.c >> @@ -1829,11 +1829,19 @@ static int matroska_parse_block(MatroskaDemuxContext >> *matroska, uint8_t *data, >> } >> total += lace_size[n]; >> } >> + if (size <= total) { >> + res = AVERROR_INVALIDDATA; >> + goto end; >> + } >> lace_size[n] = size - total; >> break; >> } >> >> case 0x2: /* fixed-size lacing */ >> + if (size != (size / laces) * size) { > > This looks wrong, it's equivalent to (size != laces) which doesn't make > much sense.
if (size % laces) -- Måns Rullgård [email protected] _______________________________________________ libav-devel mailing list [email protected] https://lists.libav.org/mailman/listinfo/libav-devel
