[vlc-commits] demux: ogg: check packets header size (fix #13875)

[Francois Cartegnie]

vlc/vlc-2.1 | branch: master | Francois Cartegnie <fcvlcdev at free.fr> | Thu Feb 12 11:17:22 2015 +0100| [d785c65b6a9e809568f69aef0fa529f39f8b5923] | committer: Jean-Baptiste Kempf

demux: ogg: check packets header size (fix #13875)

(cherry picked from commit 0b37fc45954b2da51e452bb7111f32fa61d8edc5)
Signed-off-by: Jean-Baptiste Kempf <jb at videolan.org>

> http://git.videolan.org/gitweb.cgi/vlc/vlc-2.1.git/?a=commit;h=d785c65b6a9e809568f69aef0fa529f39f8b5923
---

 modules/demux/ogg.c |    7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/modules/demux/ogg.c b/modules/demux/ogg.c
index 967438d..28e7cf0 100644
--- a/modules/demux/ogg.c
+++ b/modules/demux/ogg.c
@@ -1019,6 +1019,13 @@ static void Ogg_DecodePacket( demux_t *p_demux,
         i_header_len = (*p_oggpacket->packet & PACKET_LEN_BITS01) >> 6;
         i_header_len |= (*p_oggpacket->packet & PACKET_LEN_BITS2) << 1;
 
+        if( i_header_len >= p_oggpacket->bytes )
+        {
+            msg_Dbg( p_demux, "discarding invalid packet" );
+            block_Release( p_block );
+            return;
+        }
+
         if( p_stream->fmt.i_codec == VLC_CODEC_SUBT)
         {
             /* But with subtitles we need to retrieve the duration first */