generic-library/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

avformat/wc3movie: Check strings before printing.

Browse Source 
Fixes use of uninitialized memory
Fixes: msan_uninit-mem_7f7812ca062f_2812_SC_32_part.MVE
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2013-12-21 12:52:23 +01:00
parent 8a0d446ad6
commit 1acd029f40
1 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
libavformat/wc3movie.c
View File

@ -27,6 +27,7 @@
* http://www.pcisys.net/~melanson/codecs/ * http://www.pcisys.net/~melanson/codecs/
*/ */
#include "libavutil/avstring.h"
#include "libavutil/channel_layout.h" #include "libavutil/channel_layout.h"
#include "libavutil/intreadwrite.h" #include "libavutil/intreadwrite.h"
#include "libavutil/dict.h" #include "libavutil/dict.h"
@ -249,10 +250,16 @@ static int wc3_read_packet(AVFormatContext *s,
else { else {
int i = 0; int i = 0;
av_log (s, AV_LOG_DEBUG, "Subtitle time!\n"); av_log (s, AV_LOG_DEBUG, "Subtitle time!\n");
if (i >= size || av_strnlen(&text[i + 1], size - i - 1) >= size - i - 1)
return AVERROR_INVALIDDATA;
av_log (s, AV_LOG_DEBUG, " inglish: %s\n", &text[i + 1]); av_log (s, AV_LOG_DEBUG, " inglish: %s\n", &text[i + 1]);
i += text[i] + 1; i += text[i] + 1;
if (i >= size || av_strnlen(&text[i + 1], size - i - 1) >= size - i - 1)
return AVERROR_INVALIDDATA;
av_log (s, AV_LOG_DEBUG, " doytsch: %s\n", &text[i + 1]); av_log (s, AV_LOG_DEBUG, " doytsch: %s\n", &text[i + 1]);
i += text[i] + 1; i += text[i] + 1;
if (i >= size || av_strnlen(&text[i + 1], size - i - 1) >= size - i - 1)
return AVERROR_INVALIDDATA;
av_log (s, AV_LOG_DEBUG, " fronsay: %s\n", &text[i + 1]); av_log (s, AV_LOG_DEBUG, " fronsay: %s\n", &text[i + 1]);
} }
#endif #endif