[MPlayer-cvslog] r21985 - in trunk/libmpdemux: asfheader.c aviheader.c

[reimar]

Author: reimar
Date: Sun Jan 21 19:22:07 2007
New Revision: 21985

Modified:
   trunk/libmpdemux/asfheader.c
   trunk/libmpdemux/aviheader.c

Log:
Sanity-check sh_video->bih->biSize


Modified: trunk/libmpdemux/asfheader.c
==============================================================================
--- trunk/libmpdemux/asfheader.c	(original)
+++ trunk/libmpdemux/asfheader.c	Sun Jan 21 19:22:07 2007
@@ -420,6 +420,8 @@
         sh_video->bih=calloc((len<sizeof(BITMAPINFOHEADER))?sizeof(BITMAPINFOHEADER):len,1);
         memcpy(sh_video->bih,&buffer[4+4+1+2],len);
 	le2me_BITMAPINFOHEADER(sh_video->bih);
+	if (sh_video->bih->biSize > len && sh_video->bih->biSize > sizeof(BITMAPINFOHEADER))
+		sh_video->bih->biSize = len;
         if (sh_video->bih->biCompression == mmioFOURCC('D', 'V', 'R', ' ')) {
           //mp_msg(MSGT_DEMUXER, MSGL_WARN, MSGTR_MPDEMUX_ASFHDR_DVRWantsLibavformat);
           //sh_video->fps=(float)sh_video->video.dwRate/(float)sh_video->video.dwScale;

Modified: trunk/libmpdemux/aviheader.c
==============================================================================
--- trunk/libmpdemux/aviheader.c	(original)
+++ trunk/libmpdemux/aviheader.c	Sun Jan 21 19:22:07 2007
@@ -262,6 +262,8 @@
         mp_msg(MSGT_HEADER,MSGL_V,MSGTR_MPDEMUX_AVIHDR_FoundBitmapInfoHeader,chunksize,sizeof(BITMAPINFOHEADER));
         stream_read(demuxer->stream,(char*) sh_video->bih,chunksize);
 	le2me_BITMAPINFOHEADER(sh_video->bih);  // swap to machine endian
+	if (sh_video->bih->biSize > chunksize && sh_video->bih->biSize > sizeof(BITMAPINFOHEADER))
+		sh_video->bih->biSize = chunksize;
 	// fixup MS-RLE header (seems to be broken for <256 color files)
 	if(sh_video->bih->biCompression<=1 && sh_video->bih->biSize==40)
 	    sh_video->bih->biSize=chunksize;