[MPlayer-dev-eng] [PATCH] boundary check for demux_real.c

[Roberto Togni]

On Sat, 7 Jul 2007 21:41:03 +0800
陆然 <hephooey at gmail.com> wrote:

> Hi,
> 
> Here is a simple patch to fix the crash when playing broken rmvb files. 
> Basiclly the sub packets could not be larger than the packet, but sometimes 
> files contain garbage looks like a video sub packet but gives a huge length, 
> when mplayer try to copy the data it will crash.
> 

The idea is ok, but shouldn't len be checked against the remaining size
of the packet (ie. vpkg_length - the size of blocks already received)?

Ciao,
 Roberto