asf: prevent packet_size_left from going negative if hdrlen > pktlen.
authorRonald S. Bultje <rsbultje@gmail.com>
Fri, 17 Feb 2012 20:21:18 +0000 (12:21 -0800)
committerRonald S. Bultje <rsbultje@gmail.com>
Sat, 18 Feb 2012 17:12:32 +0000 (09:12 -0800)
This prevents failed assertions further down in the packet processing
where we require non-negative values for packet_size_left.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
libavformat/asfdec.c

index bae0eac..2922ecf 100644 (file)
@@ -789,6 +789,13 @@ static int ff_asf_get_packet(AVFormatContext *s, AVIOContext *pb)
         asf->packet_segments = 1;
         asf->packet_segsizetype = 0x80;
     }
+    if (rsize > packet_length - padsize) {
+        asf->packet_size_left = 0;
+        av_log(s, AV_LOG_ERROR,
+               "invalid packet header length %d for pktlen %d-%d at %"PRId64"\n",
+               rsize, packet_length, padsize, avio_tell(pb));
+        return -1;
+    }
     asf->packet_size_left = packet_length - padsize - rsize;
     if (packet_length < asf->hdr.min_pktsize)
         padsize += asf->hdr.min_pktsize - packet_length;