[MPlayer-cvslog] r32832 - trunk/libmpdemux/demux_asf.c

[reimar]

Author: reimar
Date: Sun Jan 30 11:38:10 2011
New Revision: 32832

Log:
Check that rlen is valid before using it to increment a pointer.

Modified:
   trunk/libmpdemux/demux_asf.c

Modified: trunk/libmpdemux/demux_asf.c
==============================================================================
--- trunk/libmpdemux/demux_asf.c	Sun Jan 30 11:35:00 2011	(r32831)
+++ trunk/libmpdemux/demux_asf.c	Sun Jan 30 11:38:10 2011	(r32832)
@@ -469,6 +469,10 @@ static int demux_asf_fill_buffer(demuxer
 	      rlen = read_varlen(&p, segtype, 0);
 
 //	      printf("### rlen=%d   \n",rlen);
+              if (rlen < 0 || rlen > p_end - p) {
+                mp_msg(MSGT_DEMUX, MSGL_V, "invalid rlen=%d\n", rlen);
+                break;
+              }
 
               switch(rlen){
               case 0x01: // 1 = special, means grouping