[MPlayer-cvslog] CVS: main/libmpdemux demux_ogg.c,1.74,1.75

[Nico Sabbi CVS]

CVS change done by Nico Sabbi CVS

Update of /cvsroot/mplayer/main/libmpdemux
In directory mail:/var2/tmp/cvs-serv17077

Modified Files:
	demux_ogg.c 
Log Message:
prevent possible exploit

Index: demux_ogg.c
===================================================================
RCS file: /cvsroot/mplayer/main/libmpdemux/demux_ogg.c,v
retrieving revision 1.74
retrieving revision 1.75
diff -u -r1.74 -r1.75
--- demux_ogg.c	12 May 2005 23:27:22 -0000	1.74
+++ demux_ogg.c	13 May 2005 00:00:54 -0000	1.75
@@ -758,6 +758,7 @@
   ogg_packet op[3];
   unsigned char *buf[3];
   unsigned char *ptr;
+  unsigned int len;
 
   for(i = 0; i < 3; i++) {
     op[i].bytes = ds_get_packet(sh->ds, &(op[i].packet));
@@ -772,7 +773,8 @@
     memcpy(buf[i], op[i].packet, op[i].bytes);
   }
 
-  sh->wf = (WAVEFORMATEX*)calloc(1, sizeof(WAVEFORMATEX) + op[0].bytes + op[1].bytes + op[2].bytes + 64);
+  len = op[0].bytes + op[1].bytes + op[2].bytes;
+  sh->wf = (WAVEFORMATEX*)calloc(1, sizeof(WAVEFORMATEX) + len + len/255 + 64);
   ptr = (unsigned char*) (sh->wf+1);
 
   ptr[0] = 2;