oysteikt/mpd
0
0
Fork 0
Code Issues Pull Requests Releases Activity

aac: check buffer lengths

Browse Source 
The AAC plugin sometimes does not check the length of available data
when checking for magic prefixes.  Add length checks.
This commit is contained in:
Max Kellermann 2008-08-26 08:27:11 +02:00
parent 9131f9ebfe
commit 351dda01bd
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/inputPlugins/aac_plugin.c
View File

@ -196,7 +196,7 @@ static void initAacBuffer(InputStream * inStream, AacBuffer * b, float *length)
fillAacBuffer(b); fillAacBuffer(b);
tagsize = 0; tagsize = 0;
if (!memcmp(b->buffer, "ID3", 3)) { if (b->bytesIntoBuffer >= 10 && !memcmp(b->buffer, "ID3", 3)) {
tagsize = (b->buffer[6] << 21) | (b->buffer[7] << 14) | tagsize = (b->buffer[6] << 21) | (b->buffer[7] << 14) |
(b->buffer[8] << 7) | (b->buffer[9] << 0); (b->buffer[8] << 7) | (b->buffer[9] << 0);
@ -208,7 +208,8 @@ static void initAacBuffer(InputStream * inStream, AacBuffer * b, float *length)
if (length == NULL) if (length == NULL)
return; return;
if ((b->buffer[0] == 0xFF) && ((b->buffer[1] & 0xF6) == 0xF0)) { if (b->bytesIntoBuffer >= 2 &&
(b->buffer[0] == 0xFF) && ((b->buffer[1] & 0xF6) == 0xF0)) {
adtsParse(b, length); adtsParse(b, length);
seekInputStream(b->inStream, tagsize, SEEK_SET); seekInputStream(b->inStream, tagsize, SEEK_SET);