Fix heap-buffer-overflow in matroska_parse_block
authorDale Curtis <dalecurtis@chromium.org>
Tue, 26 Mar 2013 21:12:30 +0000 (14:12 -0700)
committerMichael Niedermayer <michaelni@gmx.at>
Thu, 9 May 2013 19:01:02 +0000 (21:01 +0200)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 81e85bc95cb1e4f8cc7b1ba71ec027c8791b55d1)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavformat/matroskadec.c

index 45c1638..f8cd81f 100644 (file)
@@ -1916,10 +1916,10 @@ static void matroska_clear_queue(MatroskaDemuxContext *matroska)
 }
 
 static int matroska_parse_laces(MatroskaDemuxContext *matroska, uint8_t **buf,
-                                int size, int type,
+                                int* buf_size, int type,
                                 uint32_t **lace_buf, int *laces)
 {
-    int res = 0, n;
+    int res = 0, n, size = *buf_size;
     uint8_t *data = *buf;
     uint32_t *lace_size;
 
@@ -2017,6 +2017,7 @@ static int matroska_parse_laces(MatroskaDemuxContext *matroska, uint8_t **buf,
 
     *buf      = data;
     *lace_buf = lace_size;
+    *buf_size = size;
 
     return res;
 }
@@ -2252,7 +2253,7 @@ static int matroska_parse_block(MatroskaDemuxContext *matroska, uint8_t *data,
             matroska->skip_to_keyframe = 0;
     }
 
-    res = matroska_parse_laces(matroska, &data, size, (flags & 0x06) >> 1,
+    res = matroska_parse_laces(matroska, &data, &size, (flags & 0x06) >> 1,
                                &lace_size, &laces);
 
     if (res)