mirrors/gstreamer
mirrors/gstreamer
1
1
Fork 0
mirror of https://gitlab.freedesktop.org/gstreamer/gstreamer.git synced 2024-11-24 02:31:03 +00:00
Code Issues 1 Projects Releases Wiki Activity

gst-libs/gst/riff/riff-media.c: Make sure we don't read beyond the palette buffer in case of

Browse source 
Original commit message from CVS:
* gst-libs/gst/riff/riff-media.c: (gst_riff_create_video_caps):
Make sure we don't read beyond the palette buffer in case of
broken or manipulated files (#333488, patch by: Fabrizio
Gennari)
This commit is contained in:
Fabrizio 2006-03-10 11:09:23 +00:00 committed by Tim-Philipp Müller
parent 72122e4a86
commit 8d9e3abb5b
2 changed files with 22 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
ChangeLog
View file

@ -1,3 +1,10 @@
2006-03-10 Tim-Philipp Müller <tim at centricular dot net>
* gst-libs/gst/riff/riff-media.c: (gst_riff_create_video_caps):
Make sure we don't read beyond the palette buffer in case of
broken or manipulated files (#333488, patch by: Fabrizio
Gennari)
2006-03-10 Edward Hervey <edward@fluendo.com>
* gst/typefind/gsttypefindfunctions.c: (mp3_type_find_at_offset):

26
gst-libs/gst/riff/riff-media.c
View file

@ -556,21 +556,25 @@ gst_riff_create_video_caps (guint32 codec_fcc,
else
num_colors = 256;
/* palette is always at least 256*4 bytes */
copy = gst_buffer_new_and_alloc (MAX (num_colors * 4, 256 * 4));
memcpy (GST_BUFFER_DATA (copy), GST_BUFFER_DATA (palette),
GST_BUFFER_SIZE (palette));
if (GST_BUFFER_SIZE (palette) >= (num_colors * 4)) {
/* palette is always at least 256*4 bytes */
copy = gst_buffer_new_and_alloc (MAX (num_colors * 4, 256 * 4));
memcpy (GST_BUFFER_DATA (copy), GST_BUFFER_DATA (palette),
GST_BUFFER_SIZE (palette));
#if (G_BYTE_ORDER == G_BIG_ENDIAN)
gint n;
guint32 *data = (guint32 *) GST_BUFFER_DATA (copy);
gint n;
guint32 *data = (guint32 *) GST_BUFFER_DATA (copy);
/* own endianness */
for (n = 0; n < num_colors; n++)
data[n] = GUINT32_FROM_LE (data[n]);
/* own endianness */
for (n = 0; n < num_colors; n++)
data[n] = GUINT32_FROM_LE (data[n]);
#endif
gst_caps_set_simple (caps, "palette_data", GST_TYPE_BUFFER, copy, NULL);
gst_buffer_unref (copy);
gst_caps_set_simple (caps, "palette_data", GST_TYPE_BUFFER, copy, NULL);
gst_buffer_unref (copy);
} else {
GST_WARNING ("Palette smaller than expected: broken file");
}
}
return caps;