Commit 0b37fc45 authored by Francois Cartegnie's avatar Francois Cartegnie

demux: ogg: check packets header size (fix #13875)

parent 300ce853
...@@ -1408,6 +1408,13 @@ static void Ogg_DecodePacket( demux_t *p_demux, ...@@ -1408,6 +1408,13 @@ static void Ogg_DecodePacket( demux_t *p_demux,
i_header_len = (*p_oggpacket->packet & PACKET_LEN_BITS01) >> 6; i_header_len = (*p_oggpacket->packet & PACKET_LEN_BITS01) >> 6;
i_header_len |= (*p_oggpacket->packet & PACKET_LEN_BITS2) << 1; i_header_len |= (*p_oggpacket->packet & PACKET_LEN_BITS2) << 1;
if( i_header_len >= p_oggpacket->bytes )
{
msg_Dbg( p_demux, "discarding invalid packet" );
block_Release( p_block );
return;
}
if( p_stream->fmt.i_codec == VLC_CODEC_SUBT) if( p_stream->fmt.i_codec == VLC_CODEC_SUBT)
{ {
/* But with subtitles we need to retrieve the duration first */ /* But with subtitles we need to retrieve the duration first */
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment