vlc/vlc-3.0 | branch: master | Thomas Guillem <[email protected]> | Wed Jun 5 14:28:59 2019 +0200| [fc6375d4fb8a1c324619037ff3e570f8cd30c7e7] | committer: Thomas Guillem
audiotrack: check buffer length (cherry picked from commit 6267775649af7d9433973e570638e6c24b5c7698) Signed-off-by: Thomas Guillem <[email protected]> > http://git.videolan.org/gitweb.cgi/vlc/vlc-3.0.git/?a=commit;h=fc6375d4fb8a1c324619037ff3e570f8cd30c7e7 --- modules/audio_output/audiotrack.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/modules/audio_output/audiotrack.c b/modules/audio_output/audiotrack.c index 23becdc718..dcc1c254e1 100644 --- a/modules/audio_output/audiotrack.c +++ b/modules/audio_output/audiotrack.c @@ -1748,6 +1748,9 @@ ConvertFromIEC61937( audio_output_t *p_aout, block_t *p_buffer ) VLC_UNUSED( p_aout ); uint8_t i_length_mul; + if( p_buffer->i_buffer < 6 ) + return -1; + switch( GetWBE( &p_buffer->p_buffer[4] ) & 0xFF ) { case 0x01: /* IEC61937_AC3 */ @@ -1768,8 +1771,13 @@ ConvertFromIEC61937( audio_output_t *p_aout, block_t *p_buffer ) uint16_t i_length = GetWBE( &p_buffer->p_buffer[6] ); if( i_length == 0 ) return -1; + + i_length /= i_length_mul; + if( i_length > p_buffer->i_buffer - 8 ) + return -1; + p_buffer->p_buffer += 8; /* SPDIF_HEADER_SIZE */ - p_buffer->i_buffer = i_length / i_length_mul; + p_buffer->i_buffer = i_length; return 0; } _______________________________________________ vlc-commits mailing list [email protected] https://mailman.videolan.org/listinfo/vlc-commits
