| commit | fdf622ded070640a924e63a6e630325520d0b567 | |
| author | reimar <reimar@9553f0bf-9b14-0410-a0b8-cfaf0461ba5b> | |
| Thu, 24 Sep 2009 15:37:09 +0000 (24 15:37 +0000) | ||
| committer | reimar <reimar@9553f0bf-9b14-0410-a0b8-cfaf0461ba5b> | |
| Thu, 24 Sep 2009 15:37:09 +0000 (24 15:37 +0000) | ||
| tree | e2ff49399a7fc8d5eb61dae355a0807db2cae453 | treesnapshot (tar.gz zip) |
| parent | b59a466a33c5194831452eea8e20ee91e7bc4c4c | commitdiff |
Fix possible buffer over-read in vorbis_comment, fix it double to be sure.
First, make s signed, so that comparisons against end - p will not be made as
unsigned, making the check incorrectly pass if p is beyond end.
Also ensure that p will never be > end, so the code is correct also if
buf is not padded.
git-svn-id: file:///var/local/repositories/ffmpeg/trunk@20014 9553f0bf-9b14-0410-a0b8-cfaf0461ba5b
First, make s signed, so that comparisons against end - p will not be made as
unsigned, making the check incorrectly pass if p is beyond end.
Also ensure that p will never be > end, so the code is correct also if
buf is not padded.
git-svn-id: file:///var/local/repositories/ffmpeg/trunk@20014 9553f0bf-9b14-0410-a0b8-cfaf0461ba5b
| libavformat/oggparsevorbis.c | diffblobblamehistory |