On Tue, Apr 28, 2015 at 08:57:39PM +0200, Andreas Cadhalpun wrote:
> The existing check has two problems:
> 1) i + count can overflow, so that the check '< 256' returns true.
> 2) In the (i == 'N') case occurs a j-- so that the loop runs once more.
>
> This can trigger the assertion 'nut->header_len[0] == 0' or cause
> segmentation faults or infinite hangs.
>
> Signed-off-by: Andreas Cadhalpun <andreas.cadhal...@googlemail.com>
> ---
> libavformat/nutdec.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/libavformat/nutdec.c b/libavformat/nutdec.c
> index 1bb2091..46946d3 100644
> --- a/libavformat/nutdec.c
> +++ b/libavformat/nutdec.c
> @@ -294,7 +294,7 @@ static int decode_main_header(NUTContext *nut)
> while (tmp_fields-- > 8)
> ffio_read_varlen(bc);
>
> - if (count == 0 || i + count > 256) {
> + if (count <= 0 || (i > 'N' && count > 256 - i) || (i <= 'N' && count
> > 255 - i)) {
this could be simplfied to:
if (count <= 0 || count > 256 - (i <= 'N') - i)) {
[...]
--
Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB
He who knows, does not speak. He who speaks, does not know. -- Lao Tsu
signature.asc
Description: Digital signature
_______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org http://ffmpeg.org/mailman/listinfo/ffmpeg-devel
