generic-library/webm
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

mkvparser: avoid rollover in UnserializeInt().

Browse Source 
- Not strictly rollover-- avoid exceeding max 64 EBML (2^26 - 2).
- Tidy up the function.

BUG=23321923

Change-Id: I172c75064c189ed0fcf224145d016fca421f60c6
This commit is contained in:
Tom Finegan 2015-08-21 11:11:51 -07:00
parent b521e3030e
commit 7a2fa0daf3
1 changed files with 16 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
mkvparser.cpp
View File

@ -17,6 +17,10 @@
#pragma warning(disable : 4996)
#endif
namespace {
const long long kMaxEbmlSigned64Bit = (1LL << 56) - 2;
}
mkvparser::IMkvReader::~IMkvReader() {}
void mkvparser::GetVersion(int& major, int& minor, int& build, int& revision) {
@ -220,24 +224,20 @@ long mkvparser::UnserializeFloat(IMkvReader* pReader, long long pos,
}
long mkvparser::UnserializeInt(IMkvReader* pReader, long long pos,
long long size, long long& result) {
long long size, long long& result_ref) {
assert(pReader);
assert(pos >= 0);
assert(size > 0);
assert(size <= 8);
{
signed char b;
char first_byte = 0;
const long status = pReader->Read(pos, 1, (unsigned char*)&first_byte);
const long status = pReader->Read(pos, 1, (unsigned char*)&b);
if (status < 0)
return status;
if (status < 0)
return status;
result = b;
++pos;
}
unsigned long long result = first_byte;
++pos;
for (long i = 1; i < size; ++i) {
unsigned char b;
@ -253,7 +253,11 @@ long mkvparser::UnserializeInt(IMkvReader* pReader, long long pos,
++pos;
}
return 0; // success
if (result > kMaxEbmlSigned64Bit)
return E_FILE_FORMAT_INVALID;
result_ref = static_cast<long long>(result);
return 0;
}
long mkvparser::UnserializeString(IMkvReader* pReader, long long pos,