[vlc-devel] commit: Fixed potential invalid access with too short packetized data. ( Laurent Aimar )

[git version control]

vlc | branch: master | Laurent Aimar <fenrir at videolan.org> | Sat Feb 27 22:37:57 2010 +0100| [873bcee7d2eb03fe944fe28dad5ca11251e51196] | committer: Laurent Aimar 

Fixed potential invalid access with too short packetized data.

> http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=873bcee7d2eb03fe944fe28dad5ca11251e51196
---

 modules/packetizer/h264.c              |    4 ++--
 modules/packetizer/mpeg4video.c        |    2 +-
 modules/packetizer/mpegvideo.c         |    4 ++--
 modules/packetizer/packetizer_helper.h |   20 ++++++++++++++++----
 modules/packetizer/vc1.c               |    2 +-
 5 files changed, 22 insertions(+), 10 deletions(-)

diff --git a/modules/packetizer/h264.c b/modules/packetizer/h264.c
index 58fe36f..37eb011 100644
--- a/modules/packetizer/h264.c
+++ b/modules/packetizer/h264.c
@@ -202,7 +202,7 @@ static int Open( vlc_object_t *p_this )
 
     packetizer_Init( &p_sys->packetizer,
                      p_h264_startcode, sizeof(p_h264_startcode),
-                     p_h264_startcode, 1,
+                     p_h264_startcode, 1, 5,
                      PacketizeReset, PacketizeParse, PacketizeValidate, p_dec );
 
     p_sys->b_slice = false;
@@ -520,7 +520,7 @@ static block_t *PacketizeParse( void *p_private, bool *pb_ts_used, block_t *p_bl
     decoder_t *p_dec = p_private;
 
     /* Remove trailing 0 bytes */
-    while( p_block->i_buffer && p_block->p_buffer[p_block->i_buffer-1] == 0x00 )
+    while( p_block->i_buffer > 5 && p_block->p_buffer[p_block->i_buffer-1] == 0x00 )
         p_block->i_buffer--;
 
     return ParseNALBlock( p_dec, pb_ts_used, p_block );
diff --git a/modules/packetizer/mpeg4video.c b/modules/packetizer/mpeg4video.c
index af61cc1..84946a5 100644
--- a/modules/packetizer/mpeg4video.c
+++ b/modules/packetizer/mpeg4video.c
@@ -142,7 +142,7 @@ static int Open( vlc_object_t *p_this )
     /* Misc init */
     packetizer_Init( &p_sys->packetizer,
                      p_mp4v_startcode, sizeof(p_mp4v_startcode),
-                     NULL, 0,
+                     NULL, 0, 4,
                      PacketizeReset, PacketizeParse, PacketizeValidate, p_dec );
 
     p_sys->p_frame = NULL;
diff --git a/modules/packetizer/mpegvideo.c b/modules/packetizer/mpegvideo.c
index 52f5480..56bbcee 100644
--- a/modules/packetizer/mpegvideo.c
+++ b/modules/packetizer/mpegvideo.c
@@ -170,7 +170,7 @@ static int Open( vlc_object_t *p_this )
     /* Misc init */
     packetizer_Init( &p_sys->packetizer,
                      p_mp2v_startcode, sizeof(p_mp2v_startcode),
-                     NULL, 0,
+                     NULL, 0, 4,
                      PacketizeReset, PacketizeParse, PacketizeValidate, p_dec );
 
     p_sys->p_seq = NULL;
@@ -305,7 +305,7 @@ static block_t *PacketizeParse( void *p_private, bool *pb_ts_used, block_t *p_bl
     decoder_t *p_dec = p_private;
 
     /* Check if we have a picture start code */
-    *pb_ts_used = p_block->i_buffer >= 4 && p_block->p_buffer[3] == 0x00;
+    *pb_ts_used = p_block->p_buffer[3] == 0x00;
 
     return ParseMPEGBlock( p_dec, p_block );
 }
diff --git a/modules/packetizer/packetizer_helper.h b/modules/packetizer/packetizer_helper.h
index b2fd905..b46b465 100644
--- a/modules/packetizer/packetizer_helper.h
+++ b/modules/packetizer/packetizer_helper.h
@@ -49,6 +49,8 @@ typedef struct
     int i_au_prepend;
     const uint8_t *p_au_prepend;
 
+    unsigned i_au_min_size;
+
     void *p_private;
     packetizer_reset_t    pf_reset;
     packetizer_parse_t    pf_parse;
@@ -59,6 +61,7 @@ typedef struct
 static inline void packetizer_Init( packetizer_t *p_pack,
                                     const uint8_t *p_startcode, int i_startcode,
                                     const uint8_t *p_au_prepend, int i_au_prepend,
+                                    unsigned i_au_min_size,
                                     packetizer_reset_t pf_reset,
                                     packetizer_parse_t pf_parse,
                                     packetizer_validate_t pf_validate,
@@ -71,6 +74,7 @@ static inline void packetizer_Init( packetizer_t *p_pack,
 
     p_pack->i_au_prepend = i_au_prepend;
     p_pack->p_au_prepend = p_au_prepend;
+    p_pack->i_au_min_size = i_au_min_size;
 
     p_pack->i_startcode = i_startcode;
     p_pack->p_startcode = p_startcode;
@@ -167,11 +171,19 @@ static inline block_t *packetizer_Packetize( packetizer_t *p_pack, block_t **pp_
             p_pack->i_offset = 0;
 
             /* Parse the NAL */
-            p_pic = p_pack->pf_parse( p_pack->p_private, &b_used_ts, p_pic );
-            if( b_used_ts )
+            if( p_pic->i_buffer < p_pack->i_au_min_size )
+            {
+                block_Release( p_pic );
+                p_pic = NULL;
+            }
+            else
             {
-                p_block_bytestream->i_dts = VLC_TS_INVALID;
-                p_block_bytestream->i_pts = VLC_TS_INVALID;
+                p_pic = p_pack->pf_parse( p_pack->p_private, &b_used_ts, p_pic );
+                if( b_used_ts )
+                {
+                    p_block_bytestream->i_dts = VLC_TS_INVALID;
+                    p_block_bytestream->i_pts = VLC_TS_INVALID;
+                }
             }
 
             if( !p_pic )
diff --git a/modules/packetizer/vc1.c b/modules/packetizer/vc1.c
index 0293feb..e3c7daa 100644
--- a/modules/packetizer/vc1.c
+++ b/modules/packetizer/vc1.c
@@ -143,7 +143,7 @@ static int Open( vlc_object_t *p_this )
 
     packetizer_Init( &p_sys->packetizer,
                      p_vc1_startcode, sizeof(p_vc1_startcode),
-                     NULL, 0,
+                     NULL, 0, 4,
                      PacketizeReset, PacketizeParse, PacketizeValidate, p_dec );
 
     p_sys->b_sequence_header = false;