[MPlayer-cvslog] CVS: main/libmpdemux demux_audio.c,1.49,1.50

[Reimar Döffinger CVS]

CVS change done by Reimar Döffinger CVS

Update of /cvsroot/mplayer/main/libmpdemux
In directory mail:/var2/tmp/cvs-serv26498

Modified Files:
	demux_audio.c 
Log Message:
check wav header length against upper limit, should protect against
some misdetections (esp. with text files).


Index: demux_audio.c
===================================================================
RCS file: /cvsroot/mplayer/main/libmpdemux/demux_audio.c,v
retrieving revision 1.49
retrieving revision 1.50
diff -u -r1.49 -r1.50
--- demux_audio.c	27 Mar 2006 17:25:41 -0000	1.49
+++ demux_audio.c	11 Apr 2006 10:43:20 -0000	1.50
@@ -27,6 +27,9 @@
   float last_pts;
 } da_priv_t;
 
+//! rather arbitrary value for maximum length of wav-format headers
+#define MAX_WAVHDR_LEN (1 * 1024 * 1024)
+
 // how many valid frames in a row we need before accepting as valid MP3
 #define MIN_MP3_HDRS 5
 
@@ -412,6 +415,11 @@
       free_sh_audio(sh_audio);
       return 0;
     }
+    if(l > MAX_WAVHDR_LEN) {
+      mp_msg(MSGT_DEMUX,MSGL_ERR,"[demux_audio] Bad wav header length: too long (%d)!!!\n",l);
+      free_sh_audio(sh_audio);
+      return 0;
+    }
     sh_audio->wf = w = (WAVEFORMATEX*)malloc(l > sizeof(WAVEFORMATEX) ? l : sizeof(WAVEFORMATEX));
     w->wFormatTag = sh_audio->format = stream_read_word_le(s);
     w->nChannels = sh_audio->channels = stream_read_word_le(s);