Commit 69619a13 authored by Chris Evans's avatar Chris Evans Committed by Ronald S. Bultje

matroskadec: fix integer underflow if header length < probe length.

This fixes a crash with specifically crafted files.
Signed-off-by: 's avatarRonald S. Bultje <rsbultje@gmail.com>
parent 95330265
......@@ -903,6 +903,8 @@ static int matroska_probe(AVProbeData *p)
* Not fully fool-proof, but good enough. */
for (i = 0; i < FF_ARRAY_ELEMS(matroska_doctypes); i++) {
int probelen = strlen(matroska_doctypes[i]);
if (total < probelen)
continue;
for (n = 4+size; n <= 4+size+total-probelen; n++)
if (!memcmp(p->buf+n, matroska_doctypes[i], probelen))
return AVPROBE_SCORE_MAX;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment