From 334fdce1d073cde2f1e1f7c7ffb7e55590e3db87 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tim-Philipp=20M=C3=BCller?= Date: Fri, 15 Dec 2006 17:59:47 +0000 Subject: [PATCH] gst/realmedia/rmdemux.c: Use alignment-safe macros here too (subbuffers ...); guard against hypothetical memory acces... Original commit message from CVS: * gst/realmedia/rmdemux.c: (gst_rmdemux_descramble_dnet_audio): Use alignment-safe macros here too (subbuffers ...); guard against hypothetical memory access beyond our given buffer in the case where the buffer size is not a multiple of 2. --- ChangeLog | 7 +++++++ gst/realmedia/rmdemux.c | 13 +++++++------ 2 files changed, 14 insertions(+), 6 deletions(-) diff --git a/ChangeLog b/ChangeLog index 551d13f14b..e650405498 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,10 @@ +2006-12-15 Tim-Philipp Müller + + * gst/realmedia/rmdemux.c: (gst_rmdemux_descramble_dnet_audio): + Use alignment-safe macros here too (subbuffers ...); guard against + hypothetical memory access beyond our given buffer in the case + where the buffer size is not a multiple of 2. + 2006-12-15 Tim-Philipp Müller * gst/asfdemux/gstasfdemux.c: (gst_asf_demux_handle_seek_event), diff --git a/gst/realmedia/rmdemux.c b/gst/realmedia/rmdemux.c index e613faff03..982f1e9a79 100644 --- a/gst/realmedia/rmdemux.c +++ b/gst/realmedia/rmdemux.c @@ -1869,18 +1869,19 @@ gst_rmdemux_descramble_dnet_audio (GstRMDemux * rmdemux, GstRMDemuxStream * stream) { GstBuffer *buf; - guint16 *data, *end; + guint8 *data, *end; buf = g_ptr_array_index (stream->subpackets, 0); g_ptr_array_index (stream->subpackets, 0) = NULL; g_ptr_array_set_size (stream->subpackets, 0); /* descramble is a bit of a misnomer, it's just byte-order swapped AC3 .. */ - data = (guint16 *) GST_BUFFER_DATA (buf); - end = (guint16 *) (GST_BUFFER_DATA (buf) + GST_BUFFER_SIZE (buf)); - while (data < end) { - *data = GUINT16_SWAP_LE_BE (*data); - ++data; + data = GST_BUFFER_DATA (buf); + end = GST_BUFFER_DATA (buf) + GST_BUFFER_SIZE (buf); + while ((data + 1) < end) { + /* byte-swap in an alignment-safe way */ + GST_WRITE_UINT16_BE (data, GST_READ_UINT16_LE (data)); + data += sizeof (guint16); } return gst_pad_push (stream->pad, buf);