FaSTTUBe/GST-Tensordecoder-ov_ep
37
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

matroskademux: Verify lace size in _parse_blockgroup_or_simpleblock

Browse Source 
Failure to do this for corrupt input can cause a subbuffer bigger
than the actual buffer to be created, quickly leading to segfault.
Test case:
bug_s222005751_r0.001____memcpy.webm
This commit is contained in:
Philip Jägenstedt 2010-05-13 12:10:54 +02:00 committed by Sebastian Dröge
parent c659c92091
commit 081f2d00aa
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
gst/matroska/matroska-demux.c
View File

@ -4636,6 +4636,11 @@ gst_matroska_demux_parse_blockgroup_or_simpleblock (GstMatroskaDemux * demux,
for (n = 0; n < laces; n++) {
GstBuffer *sub;
if (G_UNLIKELY (lace_size[n] > size)) {
GST_WARNING_OBJECT (demux, "Invalid lace size");
break;
}
sub = gst_buffer_create_sub (buf,
GST_BUFFER_SIZE (buf) - size, lace_size[n]);
GST_DEBUG_OBJECT (demux, "created subbuffer %p", sub);