[vlc-commits] demux: avi: check subindex, fix potential invalid deref

[Francois Cartegnie]

vlc | branch: master | Francois Cartegnie <fcvlcdev at free.fr> | Thu Oct 22 16:40:48 2020 +0200| [072c3bf621f34efbc81048bd5db585f554b9d1b0] | committer: Hugo Beauzée-Luyssen

demux: avi: check subindex, fix potential invalid deref

Reported by: Zhen Zhou, NSFOCUS Security Team

Signed-off-by: Hugo Beauzée-Luyssen <hugo at beauzee.fr>

> http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=072c3bf621f34efbc81048bd5db585f554b9d1b0
---

 modules/demux/avi/avi.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/modules/demux/avi/avi.c b/modules/demux/avi/avi.c
index 6159e5e4e8..8edab47a62 100644
--- a/modules/demux/avi/avi.c
+++ b/modules/demux/avi/avi.c
@@ -2511,7 +2511,8 @@ static void AVI_IndexLoad_indx( demux_t *p_demux,
                 {
                     break;
                 }
-                if( ck_sub.indx.i_indextype == AVI_INDEX_OF_CHUNKS )
+                if( ck_sub.common.i_chunk_fourcc == AVIFOURCC_indx &&
+                     ck_sub.indx.i_indextype == AVI_INDEX_OF_CHUNKS )
                     __Parse_indx( p_demux, &p_index[i_stream], pi_last_offset, &ck_sub.indx );
                 AVI_ChunkClean( p_demux->s, &ck_sub );
             }