diff --git a/ChangeLog b/ChangeLog index e17eda2e4a..4333e40744 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,8 @@ +2006-02-17 Jan Schmidt + + * gst/dvdlpcmdec/gstdvdlpcmdec.c: (gst_dvdlpcmdec_chain_dvd): + Add a small sanity check for LPCM reading. + 2006-02-17 Edward Hervey * gst/asfdemux/gstasfdemux.c: (gst_asf_demux_process_file): diff --git a/gst/dvdlpcmdec/gstdvdlpcmdec.c b/gst/dvdlpcmdec/gstdvdlpcmdec.c index cbe342123a..c1bb62dc09 100644 --- a/gst/dvdlpcmdec/gstdvdlpcmdec.c +++ b/gst/dvdlpcmdec/gstdvdlpcmdec.c @@ -323,6 +323,15 @@ gst_dvdlpcmdec_chain_dvd (GstPad * pad, GstBuffer * buf) size = GST_BUFFER_SIZE (buf); data = GST_BUFFER_DATA (buf); + if (size < 5) { + /* Buffer is too small */ + GST_ELEMENT_WARNING (dvdlpcmdec, STREAM, DECODE, + ("Invalid data found parsing LPCM packet"), + ("LPCM packet was too small. Dropping")); + ret = GST_FLOW_OK; + goto done; + } + /* We have a 5 byte header, now. * The first two bytes are a (big endian) 16 bit offset into our buffer. * The buffer timestamp refers to this offset. @@ -331,6 +340,14 @@ gst_dvdlpcmdec_chain_dvd (GstPad * pad, GstBuffer * buf) * encoded. */ first_access = (data[0] << 8) | data[1]; + if (first_access > size) { + GST_ELEMENT_WARNING (dvdlpcmdec, STREAM, DECODE, + ("Invalid data found parsing LPCM packet"), + ("LPCM packet contained invalid first access. Dropping")); + ret = GST_FLOW_OK; + goto done; + } + header = (data[2] << 16) | (data[3] << 8) | data[4]; /* see if we have a new header */