[vlc-commits] packetizer: mpeg4video: fix oob read

[Francois Cartegnie]

vlc/vlc-3.0 | branch: master | Francois Cartegnie <fcvlcdev at free.fr> | Mon Feb 19 14:13:26 2018 +0100| [f11f4160e728054d1f43fc3f47c4e79b3513c5c6] | committer: Francois Cartegnie

packetizer: mpeg4video: fix oob read

(cherry picked from commit 074f326104b8ddbdf9ad8ad8da120322271af112)

> http://git.videolan.org/gitweb.cgi/vlc/vlc-3.0.git/?a=commit;h=f11f4160e728054d1f43fc3f47c4e79b3513c5c6
---

 modules/packetizer/mpeg4video.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/modules/packetizer/mpeg4video.c b/modules/packetizer/mpeg4video.c
index 1c33a3d02f..8b26ed557d 100644
--- a/modules/packetizer/mpeg4video.c
+++ b/modules/packetizer/mpeg4video.c
@@ -362,11 +362,13 @@ static int ParseVOL( decoder_t *p_dec, es_format_t *fmt,
 
     for( ;; )
     {
+        if( i_vol <= 5 )
+            return VLC_EGENERIC;
+
         if( p_vol[0] == 0x00 && p_vol[1] == 0x00 && p_vol[2] == 0x01 &&
             p_vol[3] >= 0x20 && p_vol[3] <= 0x2f ) break;
 
         p_vol++; i_vol--;
-        if( i_vol <= 4 ) return VLC_EGENERIC;
     }
 
     bs_init( &s, &p_vol[4], i_vol - 4 );