vlc | branch: master | Thomas Guillem <[email protected]> | Wed Jun 5 14:28:59 2019 +0200| [6267775649af7d9433973e570638e6c24b5c7698] | committer: Thomas Guillem
audiotrack: check buffer length > http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=6267775649af7d9433973e570638e6c24b5c7698 --- modules/audio_output/audiotrack.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/modules/audio_output/audiotrack.c b/modules/audio_output/audiotrack.c index 1d39852343..2e51bb9cbd 100644 --- a/modules/audio_output/audiotrack.c +++ b/modules/audio_output/audiotrack.c @@ -1897,6 +1897,9 @@ ConvertFromIEC61937( audio_output_t *p_aout, block_t *p_buffer ) VLC_UNUSED( p_aout ); uint8_t i_length_mul; + if( p_buffer->i_buffer < 6 ) + return -1; + switch( GetWBE( &p_buffer->p_buffer[4] ) & 0xFF ) { case 0x01: /* IEC61937_AC3 */ @@ -1917,8 +1920,13 @@ ConvertFromIEC61937( audio_output_t *p_aout, block_t *p_buffer ) uint16_t i_length = GetWBE( &p_buffer->p_buffer[6] ); if( i_length == 0 ) return -1; + + i_length /= i_length_mul; + if( i_length > p_buffer->i_buffer - 8 ) + return -1; + p_buffer->p_buffer += 8; /* SPDIF_HEADER_SIZE */ - p_buffer->i_buffer = i_length / i_length_mul; + p_buffer->i_buffer = i_length; return 0; } _______________________________________________ vlc-commits mailing list [email protected] https://mailman.videolan.org/listinfo/vlc-commits
