[vlc-commits] Avoid infinite recursion loop when parsing tags

[Denis Charmet]

vlc | branch: master | Denis Charmet <typx at dinauz.org> | Sun Dec 15 15:51:19 2013 +0100| [af3bbd8fedd882365109ab29f8da567720f2a730] | committer: Denis Charmet

Avoid infinite recursion loop when parsing tags

Fix #10028

> http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=af3bbd8fedd882365109ab29f8da567720f2a730
---

 modules/demux/mkv/matroska_segment.cpp |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/modules/demux/mkv/matroska_segment.cpp b/modules/demux/mkv/matroska_segment.cpp
index 428294c..c75eab5 100644
--- a/modules/demux/mkv/matroska_segment.cpp
+++ b/modules/demux/mkv/matroska_segment.cpp
@@ -268,6 +268,8 @@ SimpleTag * matroska_segment_c::ParseSimpleTags( KaxTagSimple *tag, int target_t
     EbmlElement *el;
     EbmlParser *ep = new EbmlParser( &es, tag, &sys.demuxer );
     SimpleTag * p_simple = new SimpleTag;
+    size_t max_size = tag->GetSize();
+    size_t size = 0;
 
     if( !p_simple )
     {
@@ -281,7 +283,7 @@ SimpleTag * matroska_segment_c::ParseSimpleTags( KaxTagSimple *tag, int target_t
     msg_Dbg( &sys.demuxer, "|   + Simple Tag ");
     try
     {
-        while( ( el = ep->Get() ) != NULL )
+        while( ( el = ep->Get() ) != NULL && size < max_size)
         {
             if( unlikely( el->GetSize() >= SIZE_MAX ) )
             {
@@ -322,6 +324,7 @@ SimpleTag * matroska_segment_c::ParseSimpleTags( KaxTagSimple *tag, int target_t
                     p_simple->sub_tags.push_back( p_st );
             }
             /*TODO Handle binary tags*/
+            size += el->HeadSize() + el->GetSize();
         }
     }
     catch(...)
@@ -339,7 +342,6 @@ SimpleTag * matroska_segment_c::ParseSimpleTags( KaxTagSimple *tag, int target_t
         delete p_simple;
         return NULL;
     }
-
     for( int i = 0; metadata_map[i].key; i++ )
     {
         if( !strcmp( p_simple->psz_tag_name, metadata_map[i].key ) &&