ogg: Fix a heap buffer overflow.
authorHugo Beauzée-Luyssen <beauze.h@gmail.com>
Mon, 30 Apr 2012 09:50:17 +0000 (11:50 +0200)
committerJean-Baptiste Kempf <jb@videolan.org>
Wed, 2 May 2012 08:58:16 +0000 (10:58 +0200)
Reported by: An anonymous contributor working with the SecuriTeam Secure
Disclosure
program (http://www.beyondsecurity.com/ssd.html)
(cherry picked from commit 6a41b030f5b7fcbe5ad7249c374172c0fdc29add)

Signed-off-by: Jean-Baptiste Kempf <jb@videolan.org>
modules/demux/ogg.c

index e659b9c..da6dab3 100644 (file)
@@ -624,7 +624,7 @@ static void Ogg_DecodePacket( demux_t *p_demux,
             if( p_stream->p_headers )
             {
                 memcpy( (unsigned char *)p_stream->p_headers + p_stream->i_headers - p_oggpacket->bytes,
-                        p_oggpacket->packet, p_stream->i_headers );
+                        p_oggpacket->packet, p_oggpacket->bytes );
             }
             else
             {