matroskadec: check element size against stream limit in ebml_parse_elem()
authorMichael Niedermayer <michaelni@gmx.at>
Sat, 4 Aug 2012 00:27:51 +0000 (02:27 +0200)
committerMichael Niedermayer <michaelni@gmx.at>
Sat, 4 Aug 2012 00:27:51 +0000 (02:27 +0200)
Fixes Ticket1195

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavformat/matroskadec.c

index f757632..2c954af 100644 (file)
@@ -945,7 +945,10 @@ static int ebml_parse_elem(MatroskaDemuxContext *matroska,
                      return ebml_parse_nest(matroska, syntax->def.n, data);
     case EBML_PASS:  return ebml_parse_id(matroska, syntax->def.n, id, data);
     case EBML_STOP:  return 1;
-    default:         return avio_skip(pb,length)<0 ? AVERROR(EIO) : 0;
+    default:
+        if(ffio_limit(pb, length) != length)
+            return AVERROR(EIO);
+        return avio_skip(pb,length)<0 ? AVERROR(EIO) : 0;
     }
     if (res == AVERROR_INVALIDDATA)
         av_log(matroska->ctx, AV_LOG_ERROR, "Invalid element\n");