mirrors/gstreamer
mirrors/gstreamer
1
1
Fork 0
mirror of https://gitlab.freedesktop.org/gstreamer/gstreamer.git synced 2025-02-02 20:42:30 +00:00
Code Issues 1 Projects Releases Wiki Activity

mpegdemux: Add extra length checks to TS scanning.

Browse source 
Add some missing size checks to the timestamp scanning
fast path.
This commit is contained in:
Jan Schmidt 2017-02-01 14:37:29 +11:00
parent 948b87bf15
commit ae98d3537b
1 changed files with 10 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
gst/mpegdemux/gstmpegdemux.c
View file

@ -2408,6 +2408,8 @@ gst_ps_demux_scan_ts (GstPsDemux * demux, const guint8 * data,
code = GST_READ_UINT32_BE (data); code = GST_READ_UINT32_BE (data);
if (G_LIKELY (code != ID_PS_PACK_START_CODE)) if (G_LIKELY (code != ID_PS_PACK_START_CODE))
goto beach; goto beach;
if (data + 12 > end)
goto beach;
/* skip start code */ /* skip start code */
data += 4; data += 4;
scr1 = GST_READ_UINT32_BE (data); scr1 = GST_READ_UINT32_BE (data);
@ -2436,12 +2438,17 @@ gst_ps_demux_scan_ts (GstPsDemux * demux, const guint8 * data,
/* SCR has been converted into units of 90Khz ticks to make it comparable /* SCR has been converted into units of 90Khz ticks to make it comparable
to DTS/PTS, that also implies 1 tick rounding error */ to DTS/PTS, that also implies 1 tick rounding error */
data += 6; data += 6;
if (data + 4 > end)
goto beach;
/* PMR:22 ! :2==11 ! reserved:5 ! stuffing_len:3 */ /* PMR:22 ! :2==11 ! reserved:5 ! stuffing_len:3 */
next32 = GST_READ_UINT32_BE (data); next32 = GST_READ_UINT32_BE (data);
if ((next32 & 0x00000300) != 0x00000300) if ((next32 & 0x00000300) != 0x00000300)
goto beach; goto beach;
stuffing_bytes = (next32 & 0x07); stuffing_bytes = (next32 & 0x07);
data += 4; data += 4;
if (data + stuffing_bytes > end)
goto beach;
while (stuffing_bytes--) { while (stuffing_bytes--) {
if (*data++ != 0xff) if (*data++ != 0xff)
goto beach; goto beach;
@ -2468,6 +2475,9 @@ gst_ps_demux_scan_ts (GstPsDemux * demux, const guint8 * data,
} }
/* Possible optional System header here */ /* Possible optional System header here */
if (data + 8 > end)
goto beach;
code = GST_READ_UINT32_BE (data); code = GST_READ_UINT32_BE (data);
len = GST_READ_UINT16_BE (data + 4); len = GST_READ_UINT16_BE (data + 4);
if (code == ID_PS_SYSTEM_HEADER_START_CODE) { if (code == ID_PS_SYSTEM_HEADER_START_CODE) {