mirrors/gstreamer
mirrors/gstreamer
1
1
Fork 0
mirror of https://gitlab.freedesktop.org/gstreamer/gstreamer.git synced 2024-11-27 12:11:13 +00:00
Code Issues 1 Projects Releases Wiki Activity

Add buffer length checks to every typefinding function

Browse source 
Original commit message from CVS:
Add buffer length checks to every typefinding function
This commit is contained in:
David Schleef 2003-07-24 08:49:43 +00:00
parent a287b1e442
commit a962c0f40c
7 changed files with 28 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
ext/audiofile/gstaftypes.c
View file

@ -58,7 +58,7 @@ gst_aftypes_type_find(GstBuffer *buf, gpointer private)
int file_format, format_version; int file_format, format_version;
gchar *type; gchar *type;
g_print("calling gst_aftypes_type_find\n"); GST_DEBUG("calling gst_aftypes_type_find");
buffer_wrap->buffer = buf; buffer_wrap->buffer = buf;
buffer_wrap->offset = 0; buffer_wrap->offset = 0;
@ -76,7 +76,7 @@ gst_aftypes_type_find(GstBuffer *buf, gpointer private)
file_format = afGetFileFormat (file, &format_version); file_format = afGetFileFormat (file, &format_version);
afCloseFile (file); afCloseFile (file);
g_print("file format: %d\n", file_format); GST_DEBUG("file format: %d", file_format);
/* reject raw data, just in case it is some other format */ /* reject raw data, just in case it is some other format */
if (file_format == AF_FILE_UNKNOWN || if (file_format == AF_FILE_UNKNOWN ||

7
ext/ivorbis/vorbis.c
View file

@ -83,7 +83,12 @@ static GstTypeDefinition vorbisdefinition = {
static GstCaps* static GstCaps*
vorbis_type_find (GstBuffer *buf, gpointer private) vorbis_type_find (GstBuffer *buf, gpointer private)
{ {
guint32 head = GUINT32_FROM_BE (*((guint32 *)GST_BUFFER_DATA (buf))); guint32 head;
if (GST_BUFFER_SIZE (buf) < 4)
return NULL;
head = GUINT32_FROM_BE (*((guint32 *)GST_BUFFER_DATA (buf)));
if (head != 0x4F676753) if (head != 0x4F676753)
return NULL; return NULL;

3
ext/swfdec/gstswfdec.c
View file

@ -631,6 +631,9 @@ swf_type_find(GstBuffer *buf, gpointer private)
{ {
gchar *data = GST_BUFFER_DATA(buf); gchar *data = GST_BUFFER_DATA(buf);
if (GST_BUFFER_SIZE (buf) < 4)
return NULL;
if((data[0] != 'F' && data[0] != 'C') || if((data[0] != 'F' && data[0] != 'C') ||
data[1] != 'W' || data[2] != 'S')return NULL; data[1] != 'W' || data[2] != 'S')return NULL;

7
ext/tarkin/gsttarkin.c
View file

@ -69,11 +69,16 @@ static GstTypeDefinition tarkindefinition =
static GstCaps* static GstCaps*
tarkin_type_find (GstBuffer *buf, gpointer private) tarkin_type_find (GstBuffer *buf, gpointer private)
{ {
guint32 head = GUINT32_FROM_BE (*((guint32 *)GST_BUFFER_DATA (buf))); guint32 head;
if (GST_BUFFER_SIZE (buf) < 4)
return NULL;
/* FIXME */ /* FIXME */
return NULL; return NULL;
head = GUINT32_FROM_BE (*((guint32 *)GST_BUFFER_DATA (buf)));
if (head != 0x4F676753) if (head != 0x4F676753)
return NULL; return NULL;

3
gst/cdxaparse/gstcdxaparse.c
View file

@ -167,6 +167,9 @@ cdxa_type_find (GstBuffer *buf,
GST_DEBUG ("cdxa_parse: typefind"); GST_DEBUG ("cdxa_parse: typefind");
if (GST_BUFFER_SIZE (buf) < 12)
return NULL;
if (GUINT32_FROM_LE (((guint32 *)data)[0]) != GST_RIFF_TAG_RIFF) if (GUINT32_FROM_LE (((guint32 *)data)[0]) != GST_RIFF_TAG_RIFF)
return NULL; return NULL;
if (GUINT32_FROM_LE (((guint32 *)data)[2]) != GST_RIFF_RIFF_CDXA) if (GUINT32_FROM_LE (((guint32 *)data)[2]) != GST_RIFF_RIFF_CDXA)

6
gst/festival/gstfestival.c
View file

@ -203,8 +203,12 @@ text_type_find (GstBuffer *buf, gpointer private)
gchar *data = GST_BUFFER_DATA (buf); gchar *data = GST_BUFFER_DATA (buf);
gint i; gint i;
/* 20 is arbitrary. 4 is definitely too small. */
if (GST_BUFFER_SIZE (buf) < 20)
return NULL;
for (i=0; i<GST_BUFFER_SIZE (buf); i++) { for (i=0; i<GST_BUFFER_SIZE (buf); i++) {
if (!isprint(*(data+i))) if (!isprint(data[i]) && data[i]!='\n')
return NULL; return NULL;
} }

3
gst/modplug/gstmodplug.cc
View file

@ -132,6 +132,9 @@ static GstElementClass *parent_class = NULL;
static GstCaps* static GstCaps*
modplug_type_find (GstBuffer *buf, gpointer priv) modplug_type_find (GstBuffer *buf, gpointer priv)
{ {
if (GST_BUFFER_SIZE (buf) < 75)
return NULL;
if (MOD_CheckType (buf) || if (MOD_CheckType (buf) ||
Mod_669_CheckType (buf) || Mod_669_CheckType (buf) ||
Amf_CheckType (buf) || Amf_CheckType (buf) ||