Don't limit CodecPrivate to 256KB

This commit is contained in:
Thomas Goyne 2014-05-20 09:44:20 -07:00
parent f522d4df8a
commit 5830fc4225
1 changed files with 15 additions and 3 deletions

View File

@ -151,6 +151,8 @@ struct MatroskaFile {
int bufpos; // current read position in buffer int bufpos; // current read position in buffer
int buflen; // valid bytes in buffer int buflen; // valid bytes in buffer
void *cpbuf;
// error reporting // error reporting
char errmsg[128]; char errmsg[128];
jmp_buf jb; jmp_buf jb;
@ -407,6 +409,9 @@ static void myvsnprintf(char *dest,unsigned dsize,const char *fmt,va_list ap)
static void errorjmp(MatroskaFile *mf,const char *fmt, ...) { static void errorjmp(MatroskaFile *mf,const char *fmt, ...) {
va_list ap; va_list ap;
mf->cache->memfree(mf->cache, mf->cpbuf);
mf->cpbuf = NULL;
va_start(ap, fmt); va_start(ap, fmt);
myvsnprintf(mf->errmsg,sizeof(mf->errmsg),fmt,ap); myvsnprintf(mf->errmsg,sizeof(mf->errmsg),fmt,ap);
va_end(ap); va_end(ap);
@ -1330,10 +1335,14 @@ static void parseTrackEntry(MatroskaFile *mf,uint64_t toplen) {
case 0x63a2: // CodecPrivate case 0x63a2: // CodecPrivate
if (cp) if (cp)
errorjmp(mf,"Duplicate CodecPrivate"); errorjmp(mf,"Duplicate CodecPrivate");
if (len>262144) // 256KB
errorjmp(mf,"CodecPrivate is too large: %d",(int)len);
cplen = (unsigned)len; cplen = (unsigned)len;
cp = alloca(cplen); if (len > 262144) { // 256KB
cp = mf->cpbuf = mf->cache->memalloc(mf->cache, cplen);
if (!cp)
errorjmp(mf,"Out of memory");
}
else
cp = alloca(cplen);
readbytes(mf,cp,(int)cplen); readbytes(mf,cp,(int)cplen);
break; break;
case 0x258688: // CodecName case 0x258688: // CodecName
@ -1514,9 +1523,12 @@ static void parseTrackEntry(MatroskaFile *mf,uint64_t toplen) {
static void parseTracks(MatroskaFile *mf,uint64_t toplen) { static void parseTracks(MatroskaFile *mf,uint64_t toplen) {
mf->seen.Tracks = 1; mf->seen.Tracks = 1;
mf->cpbuf = NULL;
FOREACH(mf,toplen) FOREACH(mf,toplen)
case 0xae: // TrackEntry case 0xae: // TrackEntry
parseTrackEntry(mf,len); parseTrackEntry(mf,len);
mf->cache->memfree(mf->cache, mf->cpbuf);
mf->cpbuf = NULL;
break; break;
ENDFOR(mf); ENDFOR(mf);
} }