0c2279a2af
- Heap overflow in libmms (related to CVE-2006-2200) - Buffer overrun in Real Media input plugin. [bug #1603458] Thanks to Roland Kay for reporting and JW for the patch. from brad@, tested by bernd@ and me
24 lines
986 B
Plaintext
24 lines
986 B
Plaintext
$OpenBSD: patch-src_input_mmsh_c,v 1.1 2006/12/07 09:21:01 steven Exp $
|
|
--- src/input/mmsh.c.orig Mon Dec 4 14:44:07 2006
|
|
+++ src/input/mmsh.c Mon Dec 4 14:45:35 2006
|
|
@@ -182,7 +182,7 @@ struct mmsh_s {
|
|
int num_stream_ids;
|
|
int stream_ids[ASF_MAX_NUM_STREAMS];
|
|
int stream_types[ASF_MAX_NUM_STREAMS];
|
|
- int packet_length;
|
|
+ uint32_t packet_length;
|
|
int64_t file_length;
|
|
char guid[37];
|
|
uint32_t bitrates[ASF_MAX_NUM_STREAMS];
|
|
@@ -491,6 +491,10 @@ static void interp_header (mmsh_t *this)
|
|
case GUID_ASF_FILE_PROPERTIES:
|
|
|
|
this->packet_length = LE_32(this->asf_header + i + 92 - 24);
|
|
+ if (this->packet_length > CHUNK_SIZE) {
|
|
+ this->packet_length = 0;
|
|
+ break;
|
|
+ }
|
|
this->file_length = LE_64(this->asf_header + i + 40 - 24);
|
|
/*lprintf ("file object, file_length = %lld, packet length = %d",
|
|
this->file_length, this->packet_count);*/
|