[MPlayer-cvslog] r35332 - trunk/sub/vobsub.c

[reimar]

Author: reimar
Date: Thu Nov  1 23:18:33 2012
New Revision: 35332

Log:
Use AV_RB32 to avoid sign extension issues and validate offset before using it.

Modified:
   trunk/sub/vobsub.c

Modified: trunk/sub/vobsub.c
==============================================================================
--- trunk/sub/vobsub.c	Thu Nov  1 23:13:14 2012	(r35331)
+++ trunk/sub/vobsub.c	Thu Nov  1 23:18:33 2012	(r35332)
@@ -40,6 +40,7 @@
 #include "path.h"
 #include "unrar_exec.h"
 #include "libavutil/common.h"
+#include "libavutil/intreadwrite.h"
 
 // Record the original -vobsubid set by commandline, since vobsub_id will be
 // overridden if slang match any of vobsub streams.
@@ -837,8 +838,7 @@ int vobsub_parse_ifo(void* this, const c
         } else if (memcmp(block, ifo_magic, strlen(ifo_magic) + 1))
             mp_msg(MSGT_VOBSUB, MSGL_ERR, "VobSub: Bad magic in IFO header\n");
         else {
-            unsigned pgci_sector = block[0xcc] << 24 | block[0xcd] << 16
-                | block[0xce] << 8 | block[0xcf];
+            unsigned pgci_sector = AV_RB32(block + 0xcc);
             int standard = (block[0x200] & 0x30) >> 4;
             int resolution = (block[0x201] & 0x0c) >> 2;
             *height = standard ? 576 : 480;
@@ -871,11 +871,11 @@ int vobsub_parse_ifo(void* this, const c
                 mp_msg(MSGT_VOBSUB, MSGL_ERR, "VobSub: Can't read IFO PGCI\n");
             else {
                 unsigned idx;
-                unsigned pgc_offset = block[0xc] << 24 | block[0xd] << 16
-                    | block[0xe] << 8 | block[0xf];
+                unsigned pgc_offset = AV_RB32(block + 0xc);
+                pgc_offset = FFMIN(pgc_offset, sizeof(block) - 0xa4 - 4*16);
                 for (idx = 0; idx < 16; ++idx) {
                     unsigned char *p = block + pgc_offset + 0xa4 + 4 * idx;
-                    palette[idx] = p[0] << 24 | p[1] << 16 | p[2] << 8 | p[3];
+                    palette[idx] = AV_RB32(p);
                 }
                 if (vob)
                     vob->have_palette = 1;