[vlc-devel] [PATCH 3/4] demux/nsv: fix 17563: invalid NSVf header size leads to infinite loop

[Filip Roséen]

According to the specification of nsv, a file header size of 0 (and
0xFFFFFFFF) is invalid; these changes prevents an infinite loop if the
size is specified as the former, while also making sure that we do not
try to parse files containing the latter.

fixes #17563

--

 - http://multimedia.cx/nsv-format.txt
---
 modules/demux/nsv.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/modules/demux/nsv.c b/modules/demux/nsv.c
index cfe9a2d..61e56c0 100644
--- a/modules/demux/nsv.c
+++ b/modules/demux/nsv.c
@@ -446,7 +446,6 @@ static int ReadNSVf( demux_t *p_demux )
 {
     /* demux_sys_t *p_sys = p_demux->p_sys; */
     const uint8_t     *p;
-    int         i_size;
 
     msg_Dbg( p_demux, "new NSVf chunk" );
     if( vlc_stream_Peek( p_demux->s, &p, 8 ) < 8 )
@@ -454,8 +453,12 @@ static int ReadNSVf( demux_t *p_demux )
         return VLC_EGENERIC;
     }
 
-    i_size = GetDWLE( &p[4] );
-    msg_Dbg( p_demux, "    - size=%d", i_size );
+    uint32_t i_header_size = GetDWLE( &p[4] );
+    msg_Dbg( p_demux, "    - size=%" PRIu32, i_header_size );
+
+    if( i_header_size == 0 || i_header_size == UINT32_MAX )
+        return VLC_EGENERIC;
+
 
     return vlc_stream_Read( p_demux->s, NULL, i_size ) == i_size ? VLC_SUCCESS : VLC_EGENERIC;
 }
-- 
2.10.1