matroskadec: fix integer underflow if header length < probe length.
authorChris Evans <cevans@chromium.org>
Wed, 20 Jul 2011 00:51:48 +0000 (17:51 -0700)
committerReinhard Tartler <siretart@tauware.de>
Thu, 21 Jul 2011 07:09:03 +0000 (09:09 +0200)
This fixes a crash with specifically crafted files.

Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>
(cherry picked from commit 69619a13c3fef940cba545cf0a283ff22771dd71)

libavformat/matroskadec.c

index 60f6c69..f74f76c 100644 (file)
@@ -900,6 +900,8 @@ static int matroska_probe(AVProbeData *p)
      * Not fully fool-proof, but good enough. */
     for (i = 0; i < FF_ARRAY_ELEMS(matroska_doctypes); i++) {
         int probelen = strlen(matroska_doctypes[i]);
+        if (total < probelen)
+            continue;
         for (n = 4+size; n <= 4+size+total-probelen; n++)
             if (!memcmp(p->buf+n, matroska_doctypes[i], probelen))
                 return AVPROBE_SCORE_MAX;