[vlc-commits] Avoid a crash with some corrupted mkvs

[Denis Charmet]

vlc | branch: master | Denis Charmet <typx at dinauz.org> | Wed Dec 28 11:37:48 2011 +0100| [2257fcdbb7b8dac11c93f27dcc531d4e4c3f1890] | committer: Jean-Baptiste Kempf

Avoid a crash with some corrupted mkvs

Should close #5659

Signed-off-by: Jean-Baptiste Kempf <jb at videolan.org>

> http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=2257fcdbb7b8dac11c93f27dcc531d4e4c3f1890
---

 modules/demux/mkv/matroska_segment.cpp |    5 +++++
 1 files changed, 5 insertions(+), 0 deletions(-)

diff --git a/modules/demux/mkv/matroska_segment.cpp b/modules/demux/mkv/matroska_segment.cpp
index 0415d95..6bb18ee 100644
--- a/modules/demux/mkv/matroska_segment.cpp
+++ b/modules/demux/mkv/matroska_segment.cpp
@@ -932,6 +932,11 @@ bool matroska_segment_c::Select( mtime_t i_start_time )
                 p_tk->fmt.i_extra       = GetDWLE( &p_bih->biSize ) - sizeof( BITMAPINFOHEADER );
                 if( p_tk->fmt.i_extra > 0 )
                 {
+                    /* Very unlikely yet possible: bug #5659*/
+                    size_t maxlen = p_tk->i_extra_data - sizeof( BITMAPINFOHEADER );
+                    p_tk->fmt.i_extra = ( p_tk->fmt.i_extra < maxlen )?
+                        p_tk->fmt.i_extra : maxlen;
+
                     p_tk->fmt.p_extra = xmalloc( p_tk->fmt.i_extra );
                     memcpy( p_tk->fmt.p_extra, &p_bih[1], p_tk->fmt.i_extra );
                 }