vlc | branch: master | Rémi Denis-Courmont <[email protected]> | Sun Oct 10 13:10:06 2010 +0300| [d626e6783470e2476b0b61d1c00aa2fe35d03bba] | committer: Rémi Denis-Courmont
dvdnav: fix potential buffer read overflow > http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=d626e6783470e2476b0b61d1c00aa2fe35d03bba --- modules/access/dvdnav.c | 10 +++++----- 1 files changed, 5 insertions(+), 5 deletions(-) diff --git a/modules/access/dvdnav.c b/modules/access/dvdnav.c index 57323b5..4bc35fe 100644 --- a/modules/access/dvdnav.c +++ b/modules/access/dvdnav.c @@ -1148,15 +1148,14 @@ static void ESSubtitleUpdate( demux_t *p_demux ) /***************************************************************************** * DemuxBlock: demux a given block *****************************************************************************/ -static int DemuxBlock( demux_t *p_demux, const uint8_t *pkt, int i_pkt ) +static int DemuxBlock( demux_t *p_demux, const uint8_t *p, int len ) { demux_sys_t *p_sys = p_demux->p_sys; - const uint8_t *p = pkt; - while( p < &pkt[i_pkt] ) + while( len > 0 ) { - int i_size = ps_pkt_size( p, &pkt[i_pkt] - p ); - if( i_size <= 0 ) + int i_size = ps_pkt_size( p, len ); + if( i_size <= 0 || i_size > len ) { break; } @@ -1226,6 +1225,7 @@ static int DemuxBlock( demux_t *p_demux, const uint8_t *pkt, int i_pkt ) } p += i_size; + len -= i_size; } return VLC_SUCCESS; _______________________________________________ vlc-commits mailing list [email protected] http://mailman.videolan.org/listinfo/vlc-commits
