[libbluray-devel] commit: Added segment size check to _decode_interactive_composition() ( hpi1 )

[git at videolan.org]

libbluray | branch: master | hpi1 <hpi1 at anonymous.org> | Thu Aug 19 14:48:50 2010 +0300| [527f81f5d9c95ccf21a49087210b41b9aeed19ac] | committer: hpi1 

Added segment size check to _decode_interactive_composition()

> http://git.videolan.org/gitweb.cgi/libbluray.git/?a=commit;h=527f81f5d9c95ccf21a49087210b41b9aeed19ac
---

 src/libbluray/decoders/ig_decode.c |    7 ++++++-
 1 files changed, 6 insertions(+), 1 deletions(-)

diff --git a/src/libbluray/decoders/ig_decode.c b/src/libbluray/decoders/ig_decode.c
index d282477..ec2c1db 100644
--- a/src/libbluray/decoders/ig_decode.c
+++ b/src/libbluray/decoders/ig_decode.c
@@ -220,7 +220,12 @@ static int _decode_interactive_composition(BITBUFFER *bb, BD_IG_INTERACTIVE_COMP
 {
     unsigned ii;
 
-    /*uint32_t length = */ bb_read(bb, 24);
+    uint32_t data_len = bb_read(bb, 24);
+    uint32_t buf_len  = bb->p_end - bb->p;
+    if (data_len != buf_len) {
+        ERROR("ig_decode_interactive(): buffer size mismatch (expected %d, have %d)\n", data_len, buf_len);
+        return 0;
+    }
 
     p->stream_model = bb_read(bb, 1);
     p->ui_model     = bb_read(bb, 1);