[vlc-commits] demux: asf: check subpayload length

[Francois Cartegnie]

vlc/vlc-3.0 | branch: master | Francois Cartegnie <fcvlcdev at free.fr> | Wed Jan 24 13:23:33 2018 +0100| [6a4d06468253cd22b2933a9c9f1ba41f6c0b7b4d] | committer: Francois Cartegnie

demux: asf: check subpayload length

(cherry picked from commit 757e099e859a00f257daac7cb0c3ad7c7af228cb)

> http://git.videolan.org/gitweb.cgi/vlc/vlc-3.0.git/?a=commit;h=6a4d06468253cd22b2933a9c9f1ba41f6c0b7b4d
---

 modules/demux/asf/asfpacket.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/modules/demux/asf/asfpacket.c b/modules/demux/asf/asfpacket.c
index 494e282eff..ed902ee701 100644
--- a/modules/demux/asf/asfpacket.c
+++ b/modules/demux/asf/asfpacket.c
@@ -349,6 +349,8 @@ static int DemuxPayload(asf_packet_sys_t *p_packetsys, asf_packet_t *pkt, int i_
         {
             i_sub_payload_data_length = pkt->p_peek[pkt->i_skip++];
             i_payload_data_length--;
+            if( i_sub_payload_data_length > i_payload_data_length )
+                goto skip;
         }
 
         SkipBytes( p_demux->s, pkt->i_skip );