[vlc-commits] audiotrack: check buffer length

[Thomas Guillem]

vlc | branch: master | Thomas Guillem <thomas at gllm.fr> | Wed Jun  5 14:28:59 2019 +0200| [6267775649af7d9433973e570638e6c24b5c7698] | committer: Thomas Guillem

audiotrack: check buffer length

> http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=6267775649af7d9433973e570638e6c24b5c7698
---

 modules/audio_output/audiotrack.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/modules/audio_output/audiotrack.c b/modules/audio_output/audiotrack.c
index 1d39852343..2e51bb9cbd 100644
--- a/modules/audio_output/audiotrack.c
+++ b/modules/audio_output/audiotrack.c
@@ -1897,6 +1897,9 @@ ConvertFromIEC61937( audio_output_t *p_aout, block_t *p_buffer )
     VLC_UNUSED( p_aout );
     uint8_t i_length_mul;
 
+    if( p_buffer->i_buffer < 6 )
+        return -1;
+
     switch( GetWBE( &p_buffer->p_buffer[4] ) & 0xFF )
     {
         case 0x01: /* IEC61937_AC3 */
@@ -1917,8 +1920,13 @@ ConvertFromIEC61937( audio_output_t *p_aout, block_t *p_buffer )
     uint16_t i_length = GetWBE( &p_buffer->p_buffer[6] );
     if( i_length == 0 )
         return -1;
+
+    i_length /= i_length_mul;
+    if( i_length > p_buffer->i_buffer - 8 )
+        return -1;
+
     p_buffer->p_buffer += 8; /* SPDIF_HEADER_SIZE */
-    p_buffer->i_buffer = i_length / i_length_mul;
+    p_buffer->i_buffer = i_length;
 
     return 0;
 }