Changeset 379212dbee5545f94dbd76c3b3f171e9b5e1fd53

Show
Ignore:
Timestamp:
27/07/08 15:38:02 (4 months ago)
Author:
Derk-Jan Hartman <hartman@videolan.org>
git-committer:
Derk-Jan Hartman <hartman@videolan.org> 1217165882 +0200
git-parent:

[5cbbb0ac7a18d404f662285f2cdef41d427adfc5]

git-author:
David Flynn <davidf@woaf.net> 1217113682 +0100
Message:

Fix handling of dirac EOSdataunit.

  • Fixes infinite loop when next_parse_offset = 0
  • Fixes memory access to invalid data with malformed ogg input.

Signed-off-by: David Flynn <davidf@woaf.net>
Signed-off-by: Derk-Jan Hartman <hartman@videolan.org>

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • modules/codec/schroedinger.c

    r5cbbb0a r379212d  
    436436            uint8_t *p_pu = p_block->p_buffer + i_bufused; 
    437437 
     438            if( 0 == i_pulen ) { 
     439                i_pulen = 13; 
     440            } 
     441 
    438442            /* blocks that do not start with the parse info prefix are invalid */ 
    439443            if( p_pu[0] != 'B' || p_pu[1] != 'B' || 

  • modules/demux/ogg.c

    r7544774 r379212d  
    15571557{ 
    15581558    uint32_t u_pos = 4; 
    1559     /* find the picture startcode */ 
    1560     while ( (p_oggpacket->packet[u_pos] & 0x08) == 0) { 
     1559    /* protect against falling off the edge */ 
     1560    while ( u_pos + 13 < p_oggpacket->bytes ) { 
     1561        /* find the picture startcode */ 
     1562        if ( p_oggpacket->packet[u_pos] & 0x08 ) { 
     1563            return GetDWBE( p_oggpacket->packet + u_pos + 9 ); 
     1564        } 
    15611565        /* skip to the next dirac parse unit */ 
    1562         u_pos += GetDWBE( p_oggpacket->packet + u_pos + 1 ); 
    1563         /* protect against falling off the edge */ 
    1564         if ( u_pos > p_oggpacket->bytes ) 
    1565              return -1; 
    1566     } 
    1567  
    1568     uint32_t u_pnum = GetDWBE( p_oggpacket->packet + u_pos + 9 ); 
    1569  
    1570     return u_pnum; 
     1566        uint32_t u_npo = GetDWBE( p_oggpacket->packet + u_pos + 1 ); 
     1567        if (u_npo == 0) 
     1568            u_npo = 13; 
     1569        u_pos += u_npo; 
     1570    } 
     1571    return -1; 
    15711572} 
    15721573