mkv: Improve PCI events handling
authorHugo Beauzée-Luyssen <hugo@beauzee.fr>
Mon, 12 Aug 2019 09:45:46 +0000 (11:45 +0200)
committerHugo Beauzée-Luyssen <hugo@beauzee.fr>
Wed, 14 Aug 2019 16:06:03 +0000 (18:06 +0200)
CVE-2019-14970

modules/demux/mkv/events.cpp
modules/demux/mkv/mkv.cpp

index 12f6c43..93cf963 100644 (file)
@@ -50,10 +50,11 @@ void event_thread_t::SetPci(const pci_t *data)
 {
     vlc_mutex_locker l(&lock);
 
-    pci_packet = *data;
+    memcpy(&pci_packet, data, sizeof(pci_packet));
 
 #ifndef WORDS_BIGENDIAN
-    for( uint8_t button = 1; button <= pci_packet.hli.hl_gi.btn_ns; button++) {
+    for( uint8_t button = 1; button <= pci_packet.hli.hl_gi.btn_ns &&
+            button < ARRAY_SIZE(pci_packet.hli.btnit); button++) {
         btni_t *button_ptr = &(pci_packet.hli.btnit[button-1]);
         binary *p_data = (binary*) button_ptr;
 
index 1b055ce..b7d8b3f 100644 (file)
@@ -668,7 +668,8 @@ void BlockDecode( demux_t *p_demux, KaxBlock *block, KaxSimpleBlock *simpleblock
             if ( track.fmt.i_cat == DATA_ES )
             {
                 // TODO handle the start/stop times of this packet
-                p_sys->ev.SetPci( (const pci_t *)&p_block->p_buffer[1]);
+                if( p_block->i_size >= sizeof(pci_t))
+                    p_sys->ev.SetPci( (const pci_t *)&p_block->p_buffer[1]);
                 block_Release( p_block );
                 return;
             }