[FFmpeg-cvslog] wtv: Add more sanity checks for a length read from the file

[Martin Storsjö]

ffmpeg | branch: release/0.10 | Martin Storsjö <martin at martin.st> | Thu Sep 19 16:55:13 2013 +0300| [f23b1cc7d979ab0153d203e2e7ecb0ca48e78abb] | committer: Luca Barbato

wtv: Add more sanity checks for a length read from the file

Also make sure the existing length check can't overflow.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable at libav.org
Signed-off-by: Martin Storsjö <martin at martin.st>
(cherry picked from commit 83c285f88016b087c2f0f4b9ef356ad8ef12d947)
Signed-off-by: Luca Barbato <lu_zero at gentoo.org>
(cherry picked from commit 78dc022f6f8a8b87773a209e0fcbea2d5b48396f)

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=f23b1cc7d979ab0153d203e2e7ecb0ca48e78abb
---

 libavformat/wtv.c |    7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/libavformat/wtv.c b/libavformat/wtv.c
index 2d5d7c5..7a66843 100644
--- a/libavformat/wtv.c
+++ b/libavformat/wtv.c
@@ -273,7 +273,12 @@ static AVIOContext * wtvfile_open2(AVFormatContext *s, const uint8_t *buf, int b
         dir_length  = AV_RL16(buf + 16);
         file_length = AV_RL64(buf + 24);
         name_size   = 2 * AV_RL32(buf + 32);
-        if (buf + 48 + name_size > buf_end) {
+        if (name_size < 0) {
+            av_log(s, AV_LOG_ERROR,
+                   "bad filename length, remaining directory entries ignored\n");
+            break;
+        }
+        if (48 + name_size > buf_end - buf) {
             av_log(s, AV_LOG_ERROR, "filename exceeds buffer size; remaining directory entries ignored\n");
             break;
         }