[vlc-commits] audiotrack: check buffer length

[Thomas Guillem]

vlc/vlc-3.0 | branch: master | Thomas Guillem <thomas at gllm.fr> | Wed Jun  5 14:28:59 2019 +0200| [fc6375d4fb8a1c324619037ff3e570f8cd30c7e7] | committer: Thomas Guillem

audiotrack: check buffer length

(cherry picked from commit 6267775649af7d9433973e570638e6c24b5c7698)
Signed-off-by: Thomas Guillem <thomas at gllm.fr>

> http://git.videolan.org/gitweb.cgi/vlc/vlc-3.0.git/?a=commit;h=fc6375d4fb8a1c324619037ff3e570f8cd30c7e7
---

 modules/audio_output/audiotrack.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/modules/audio_output/audiotrack.c b/modules/audio_output/audiotrack.c
index 23becdc718..dcc1c254e1 100644
--- a/modules/audio_output/audiotrack.c
+++ b/modules/audio_output/audiotrack.c
@@ -1748,6 +1748,9 @@ ConvertFromIEC61937( audio_output_t *p_aout, block_t *p_buffer )
     VLC_UNUSED( p_aout );
     uint8_t i_length_mul;
 
+    if( p_buffer->i_buffer < 6 )
+        return -1;
+
     switch( GetWBE( &p_buffer->p_buffer[4] ) & 0xFF )
     {
         case 0x01: /* IEC61937_AC3 */
@@ -1768,8 +1771,13 @@ ConvertFromIEC61937( audio_output_t *p_aout, block_t *p_buffer )
     uint16_t i_length = GetWBE( &p_buffer->p_buffer[6] );
     if( i_length == 0 )
         return -1;
+
+    i_length /= i_length_mul;
+    if( i_length > p_buffer->i_buffer - 8 )
+        return -1;
+
     p_buffer->p_buffer += 8; /* SPDIF_HEADER_SIZE */
-    p_buffer->i_buffer = i_length / i_length_mul;
+    p_buffer->i_buffer = i_length;
 
     return 0;
 }