提交 08169fc3 编写于 作者: M Michael Niedermayer

matroskadec: move lace_size check up so it catches all code pathes

Signed-off-by: NMichael Niedermayer <michaelni@gmx.at>
上级 88a740af
......@@ -1975,6 +1975,11 @@ static int matroska_parse_block(MatroskaDemuxContext *matroska, uint8_t *data,
if (res == 0) {
for (n = 0; n < laces; n++) {
if (lace_size[n] > size) {
av_log(matroska->ctx, AV_LOG_ERROR, "Invalid packet size\n");
break;
}
if ((st->codec->codec_id == CODEC_ID_RA_288 ||
st->codec->codec_id == CODEC_ID_COOK ||
st->codec->codec_id == CODEC_ID_SIPR ||
......@@ -2044,11 +2049,6 @@ static int matroska_parse_block(MatroskaDemuxContext *matroska, uint8_t *data,
uint32_t pkt_size = lace_size[n];
uint8_t *pkt_data = data;
if (pkt_size > size) {
av_log(matroska->ctx, AV_LOG_ERROR, "Invalid packet size\n");
break;
}
if (encodings && encodings->scope & 1) {
offset = matroska_decode_buffer(&pkt_data,&pkt_size, track);
if (offset < 0)
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册