diff options
| author | Edward Hervey <edward@centricular.com> | 2017-11-02 15:14:49 +0100 |
|---|---|---|
| committer | Edward Hervey <bilboed@bilboed.com> | 2017-11-02 17:59:29 +0100 |
| commit | a23d4d1c1f54dbe1b269712587721ee914f713b5 (patch) | |
| tree | 48fb6b3bc2bf8c3f7b259559a4af91144f4d074d /gst/typefind | |
| parent | 24a5a03d27332f5eaa82beb2facce5b78e2ac6f3 (diff) | |
typefind: Fix out-of-bound read in PNM typefinder
Diffstat (limited to 'gst/typefind')
| -rw-r--r-- | gst/typefind/gsttypefindfunctions.c | 13 |
1 files changed, 11 insertions, 2 deletions
diff --git a/gst/typefind/gsttypefindfunctions.c b/gst/typefind/gsttypefindfunctions.c index 2bbb88daf..38a50e7ba 100644 --- a/gst/typefind/gsttypefindfunctions.c +++ b/gst/typefind/gsttypefindfunctions.c @@ -4148,15 +4148,24 @@ pnm_type_find (GstTypeFind * tf, gpointer ununsed) /* need to skip any comment lines first */ data_scan_ctx_advance (tf, &c, 3); + + if (!data_scan_ctx_ensure_data (tf, &c, 1)) + return; + while (c.data[0] == '#') { /* we know there's still data left */ data_scan_ctx_advance (tf, &c, 1); + if (!data_scan_ctx_ensure_data (tf, &c, 1)) + return; + while (c.data[0] != '\n' && c.data[0] != '\r') { - if (!data_scan_ctx_ensure_data (tf, &c, 4)) - return; data_scan_ctx_advance (tf, &c, 1); + if (!data_scan_ctx_ensure_data (tf, &c, 1)) + return; } data_scan_ctx_advance (tf, &c, 1); GST_LOG ("skipped comment line in PNM header"); + if (!data_scan_ctx_ensure_data (tf, &c, 1)) + return; } if (!data_scan_ctx_ensure_data (tf, &c, 32) && |