matroskadec: fix integer underflow if header length < probe length.
This fixes a crash with specifically crafted files.
Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>
(cherry picked from commit 69619a13c3)
			
			
This commit is contained in:
		
				
					committed by
					
						
						Reinhard Tartler
					
				
			
			
				
	
			
			
			
						parent
						
							20829cf8a2
						
					
				
				
					commit
					5fab0ccd81
				
			@@ -900,6 +900,8 @@ static int matroska_probe(AVProbeData *p)
 | 
			
		||||
     * Not fully fool-proof, but good enough. */
 | 
			
		||||
    for (i = 0; i < FF_ARRAY_ELEMS(matroska_doctypes); i++) {
 | 
			
		||||
        int probelen = strlen(matroska_doctypes[i]);
 | 
			
		||||
        if (total < probelen)
 | 
			
		||||
            continue;
 | 
			
		||||
        for (n = 4+size; n <= 4+size+total-probelen; n++)
 | 
			
		||||
            if (!memcmp(p->buf+n, matroska_doctypes[i], probelen))
 | 
			
		||||
                return AVPROBE_SCORE_MAX;
 | 
			
		||||
 
 | 
			
		||||
		Reference in New Issue
	
	Block a user