har0ke/FFmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

avformat/ac3dec: Check buf2 before adding 16 in ac3_eac3_probe()

Browse Source 
This is needed since e0250cf3651e6417e0117486a7816b45fb2d34cd as that uses end-buf2
Note, there are more than 16 bytes allocated beyond "end"

Fixes: regression (segfault) with probetest

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2017-10-28 16:16:46 +02:00
parent 8013753113
commit eb54efc1e1
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
libavformat/ac3dec.c
View File

@ -47,8 +47,11 @@ static int ac3_eac3_probe(AVProbeData *p, enum AVCodecID expected_codec_id)
uint16_t frame_size;
int i, ret;
if(!memcmp(buf2, "\x1\x10\0\0\0\0\0\0", 8))
if(!memcmp(buf2, "\x1\x10\0\0\0\0\0\0", 8)) {
if (buf2 + 16 > end)
break;
buf2+=16;
}
if (buf[0] == 0x77 && buf[1] == 0x0B) {
for(i=0; i<8; i+=2) {
buf3[i ] = buf2[i+1];