mirror of
https://gitlab.freedesktop.org/gstreamer/gstreamer.git
synced 2025-04-10 10:04:23 +00:00
vc1: fix size of encapsulated BDU.
Fix size of encapsulated BDUs since GstVC1BDU.size actually represents the size of the BDU data, starting from offset, i.e. after any start code is parsed. This fixes a buffer overflow during the unescaping process.
This commit is contained in:
parent
a68c218c8e
commit
df411e435f
1 changed files with 2 additions and 2 deletions
|
@ -1024,7 +1024,7 @@ decode_buffer(GstVaapiDecoderVC1 *decoder, guchar *buf, guint buf_size)
|
|||
ebdu.offset = 4;
|
||||
}
|
||||
ebdu.data = buf;
|
||||
ebdu.size = buf_size;
|
||||
ebdu.size = buf_size - ebdu.offset;
|
||||
return decode_ebdu(decoder, &ebdu);
|
||||
}
|
||||
|
||||
|
@ -1098,7 +1098,7 @@ decode_codec_data(GstVaapiDecoderVC1 *decoder, GstBuffer *buffer)
|
|||
switch (result) {
|
||||
case GST_VC1_PARSER_NO_BDU_END:
|
||||
/* Assume the EBDU is complete within codec-data bounds */
|
||||
ebdu.size = buf_size - ofs - (ebdu.offset - ebdu.sc_offset);
|
||||
ebdu.size = buf_size - ofs - ebdu.offset;
|
||||
// fall-through
|
||||
case GST_VC1_PARSER_OK:
|
||||
status = decode_ebdu(decoder, &ebdu);
|
||||
|
|
Loading…
Reference in a new issue