[libdvdnav-devel] [Git][videolan/libdvdread][master] ifo_read: check the number of commands is within the boundaries

[Jean-Baptiste Kempf (@jbk)]

Jean-Baptiste Kempf pushed to branch master at VideoLAN / libdvdread


Commits:
361502a1 by Steve Lhomme at 2022-05-15T08:00:34+00:00
ifo_read: check the number of commands is within the boundaries

According to [1] these 16 bits represent the "end address relative to command table".
This corresponds to the last_byte check in other places.

[1] http://dvd.sourceforge.net/dvdinfo/pgc.html#cmd

- - - - -


2 changed files:

- src/dvdread/ifo_types.h
- src/ifo_read.c


Changes:

=====================================
src/dvdread/ifo_types.h
=====================================
@@ -191,7 +191,7 @@ typedef struct {
   uint16_t nr_of_pre;
   uint16_t nr_of_post;
   uint16_t nr_of_cell;
-  uint16_t zero_1;
+  uint16_t last_byte;
   vm_cmd_t *pre_cmds;
   vm_cmd_t *post_cmds;
   vm_cmd_t *cell_cmds;


=====================================
src/ifo_read.c
=====================================
@@ -733,8 +733,11 @@ static int ifoRead_PGC_COMMAND_TBL(ifo_handle_t *ifofile,
   B2N_16(cmd_tbl->nr_of_pre);
   B2N_16(cmd_tbl->nr_of_post);
   B2N_16(cmd_tbl->nr_of_cell);
+  B2N_16(cmd_tbl->last_byte);
 
   CHECK_VALUE(cmd_tbl->nr_of_pre + cmd_tbl->nr_of_post + cmd_tbl->nr_of_cell<= 255);
+  CHECK_VALUE((cmd_tbl->nr_of_pre + cmd_tbl->nr_of_post + cmd_tbl->nr_of_cell) * COMMAND_DATA_SIZE
+              + PGC_COMMAND_TBL_SIZE <= cmd_tbl->last_byte + 1);
 
   if(cmd_tbl->nr_of_pre != 0) {
     unsigned int pre_cmds_size  = cmd_tbl->nr_of_pre * COMMAND_DATA_SIZE;



View it on GitLab: https://code.videolan.org/videolan/libdvdread/-/commit/361502a1341b2f5fac7fe2c28b50f223ac814ff3

-- 
View it on GitLab: https://code.videolan.org/videolan/libdvdread/-/commit/361502a1341b2f5fac7fe2c28b50f223ac814ff3
You're receiving this email because of your account on code.videolan.org.


VideoLAN code repository instance