Traneptora/FFmpeg
1
Fork 0
forked from FFmpeg/FFmpeg
Code Pull requests Activity

avformat/ac3dec: Check buf2 before adding 16 in ac3_eac3_probe()

Browse source 
This is needed since e0250cf365 as that uses end-buf2
Note, there are more than 16 bytes allocated beyond "end"

Fixes: regression (segfault) with probetest

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2017-10-28 16:16:46 +02:00
parent 8013753113
commit eb54efc1e1
1 changed files with 4 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
libavformat/ac3dec.c
View file

@ -47,8 +47,11 @@ static int ac3_eac3_probe(AVProbeData *p, enum AVCodecID expected_codec_id)
uint16_t frame_size; uint16_t frame_size;
int i, ret; int i, ret;
if(!memcmp(buf2, "\x1\x10\0\0\0\0\0\0", 8)) if(!memcmp(buf2, "\x1\x10\0\0\0\0\0\0", 8)) {
if (buf2 + 16 > end)
break;
buf2+=16; buf2+=16;
}
if (buf[0] == 0x77 && buf[1] == 0x0B) { if (buf[0] == 0x77 && buf[1] == 0x0B) {
for(i=0; i<8; i+=2) { for(i=0; i<8; i+=2) {
buf3[i ] = buf2[i+1]; buf3[i ] = buf2[i+1];