mirrors/gstreamer
mirrors/gstreamer
1
1
Fork 0
mirror of https://gitlab.freedesktop.org/gstreamer/gstreamer.git synced 2025-01-23 23:58:17 +00:00
Code Issues 1 Projects Releases Wiki Activity

matroskademux: Verify lace size in _parse_blockgroup_or_simpleblock

Browse source 
Failure to do this for corrupt input can cause a subbuffer bigger
than the actual buffer to be created, quickly leading to segfault.
Test case:
bug_s222005751_r0.001____memcpy.webm
This commit is contained in:
Philip Jägenstedt 2010-05-13 12:10:54 +02:00 committed by Sebastian Dröge
parent c659c92091
commit 081f2d00aa
1 changed files with 5 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
gst/matroska/matroska-demux.c
View file

@ -4636,6 +4636,11 @@ gst_matroska_demux_parse_blockgroup_or_simpleblock (GstMatroskaDemux * demux,
for (n = 0; n < laces; n++) {
GstBuffer *sub;
if (G_UNLIKELY (lace_size[n] > size)) {
GST_WARNING_OBJECT (demux, "Invalid lace size");
break;
}
sub = gst_buffer_create_sub (buf,
GST_BUFFER_SIZE (buf) - size, lace_size[n]);
GST_DEBUG_OBJECT (demux, "created subbuffer %p", sub);