[vlc-commits] demux: avi: check subindex, fix potential invalid deref

[Francois Cartegnie]

vlc/vlc-3.0 | branch: master | Francois Cartegnie <fcvlcdev at free.fr> | Thu Oct 22 16:40:48 2020 +0200| [f5f8cc3ab8825f178de3f6714bfbff8b3f293fd2] | committer: Hugo Beauzée-Luyssen

demux: avi: check subindex, fix potential invalid deref

Reported by: Zhen Zhou, NSFOCUS Security Team

Signed-off-by: Hugo Beauzée-Luyssen <hugo at beauzee.fr>
(cherry picked from commit 072c3bf621f34efbc81048bd5db585f554b9d1b0)
Signed-off-by: Hugo Beauzée-Luyssen <hugo at beauzee.fr>

> http://git.videolan.org/gitweb.cgi/vlc/vlc-3.0.git/?a=commit;h=f5f8cc3ab8825f178de3f6714bfbff8b3f293fd2
---

 modules/demux/avi/avi.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/modules/demux/avi/avi.c b/modules/demux/avi/avi.c
index 8a39b5dd77..fbd08b6422 100644
--- a/modules/demux/avi/avi.c
+++ b/modules/demux/avi/avi.c
@@ -2660,7 +2660,8 @@ static void AVI_IndexLoad_indx( demux_t *p_demux,
                 {
                     break;
                 }
-                if( ck_sub.indx.i_indextype == AVI_INDEX_OF_CHUNKS )
+                if( ck_sub.common.i_chunk_fourcc == AVIFOURCC_indx &&
+                     ck_sub.indx.i_indextype == AVI_INDEX_OF_CHUNKS )
                     __Parse_indx( p_demux, &p_index[i_stream], pi_last_offset, &ck_sub.indx );
                 AVI_ChunkClean( p_demux->s, &ck_sub );
             }