[vlc-commits] demux: asf: check packet header offsets

[Francois Cartegnie]

vlc | branch: master | Francois Cartegnie <fcvlcdev at free.fr> | Wed Jan 24 14:22:34 2018 +0100| [9f7631674b76d0b76a9710116666af15e232d5f3] | committer: Francois Cartegnie

demux: asf: check packet header offsets

> http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=9f7631674b76d0b76a9710116666af15e232d5f3
---

 modules/demux/asf/asfpacket.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/modules/demux/asf/asfpacket.c b/modules/demux/asf/asfpacket.c
index 9808ac4bdb..e0e705ef24 100644
--- a/modules/demux/asf/asfpacket.c
+++ b/modules/demux/asf/asfpacket.c
@@ -480,6 +480,9 @@ int DemuxASFPacket( asf_packet_sys_t *p_packetsys,
         pkt.length = i_data_packet_min;
     }
 
+    if( i_skip + 4 > i_data_packet_min )
+        goto loop_error_recovery;
+
     pkt.send_time = GetDWLE( p_peek + i_skip ); i_skip += 4;
     /* uint16_t i_packet_duration = GetWLE( p_peek + i_skip ); */ i_skip += 2;
 
@@ -494,6 +497,8 @@ int DemuxASFPacket( asf_packet_sys_t *p_packetsys,
     pkt.length_type = 0x02; //unused
     if( pkt.multiple )
     {
+        if( i_skip + 1 >= i_data_packet_min )
+            goto loop_error_recovery;
         i_payload_count = p_peek[i_skip] & 0x3f;
         pkt.length_type = ( p_peek[i_skip] >> 6 )&0x03;
         i_skip++;