[MPlayer-cvslog] r37641 - trunk/stream/pnm.c

[reimar]

Author: reimar
Date: Tue Feb  9 22:13:26 2016
New Revision: 37641

Log:
pnm: check server message length validity.

Modified:
   trunk/stream/pnm.c

Modified: trunk/stream/pnm.c
==============================================================================
--- trunk/stream/pnm.c	Tue Feb  9 22:03:51 2016	(r37640)
+++ trunk/stream/pnm.c	Tue Feb  9 22:13:26 2016	(r37641)
@@ -662,7 +662,10 @@ static int pnm_get_stream_chunk(pnm_t *p
   {
     int size=AV_RB16(&p->buffer[1]);
 
-    rm_read (p->s, &p->buffer[8], size-5);
+    if (size > sizeof(p->buffer) - 4) size = sizeof(p->buffer) - 4;
+    if (size > 5)
+      rm_read (p->s, &p->buffer[8], size-5);
+
     p->buffer[size+3]=0;
     mp_msg(MSGT_OPEN, MSGL_WARN, "input_pnm: got message from server while reading stream:\n%s\n", &p->buffer[3]);
     return -1;