Skip to content

F
ffmpeg.wasm-core
Commit 81e85bc9 authored by Dale Curtis's avatar Dale Curtis Committed by Michael Niedermayer
Browse files
Options

Fix heap-buffer-overflow in matroska_parse_block 

Signed-off-by: 's avatarMichael Niedermayer <michaelni@gmx.at>
parent e9d3b400
Show whitespace changes
Inline Side-by-side
Showing with 4 additions and 3 deletions
libavformat/matroskadec.c
View file @ 81e85bc9
...@@ -1961,10 +1961,10 @@ static void matroska_clear_queue(MatroskaDemuxContext *matroska) ...@@ -1961,10 +1961,10 @@ static void matroska_clear_queue(MatroskaDemuxContext *matroska)
} }
static int matroska_parse_laces(MatroskaDemuxContext *matroska, uint8_t **buf, static int matroska_parse_laces(MatroskaDemuxContext *matroska, uint8_t **buf,
int size, int type, int* buf_size, int type,
uint32_t **lace_buf, int *laces) uint32_t **lace_buf, int *laces)
{ {
int res = 0, n; int res = 0, n, size = *buf_size;
uint8_t *data = *buf; uint8_t *data = *buf;
uint32_t *lace_size; uint32_t *lace_size;
...@@ -2062,6 +2062,7 @@ static int matroska_parse_laces(MatroskaDemuxContext *matroska, uint8_t **buf, ...@@ -2062,6 +2062,7 @@ static int matroska_parse_laces(MatroskaDemuxContext *matroska, uint8_t **buf,
*buf = data; *buf = data;
*lace_buf = lace_size; *lace_buf = lace_size;
*buf_size = size;
return res; return res;
} }
...@@ -2299,7 +2300,7 @@ static int matroska_parse_block(MatroskaDemuxContext *matroska, uint8_t *data, ...@@ -2299,7 +2300,7 @@ static int matroska_parse_block(MatroskaDemuxContext *matroska, uint8_t *data,
matroska->skip_to_keyframe = 0; matroska->skip_to_keyframe = 0;
} }
res = matroska_parse_laces(matroska, &data, size, (flags & 0x06) >> 1, res = matroska_parse_laces(matroska, &data, &size, (flags & 0x06) >> 1,
&lace_size, &laces); &lace_size, &laces);
if (res) if (res)
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment