asf: Fix out of bound read
authorHugo Beauzée-Luyssen <hugo@beauzee.fr>
Wed, 7 Aug 2019 15:36:37 +0000 (17:36 +0200)
committerHugo Beauzée-Luyssen <hugo@beauzee.fr>
Wed, 14 Aug 2019 16:05:59 +0000 (18:05 +0200)
p_data is already offset by 64 bytes, so we need to propagate that
offset to the boundary check

CVE-2019-14776

modules/demux/asf/asf.c

index 9dd30eb..441d9ec 100644 (file)
@@ -1105,7 +1105,7 @@ static int DemuxInit( demux_t *p_demux )
                 {
                     GET_CHECKED( fmt.i_extra, __MIN( GetWLE( &p_data[16] ),
                                          p_sp->i_type_specific_data_length -
-                                         sizeof( WAVEFORMATEX ) ),
+                                         sizeof( WAVEFORMATEX ) - 64),
                                  INT_MAX, uint32_t );
                     fmt.p_extra = malloc( fmt.i_extra );
                     if ( fmt.p_extra )