diff options
| author | Edward Hervey <edward@centricular.com> | 2017-11-02 15:14:49 +0100 |
|---|---|---|
| committer | Edward Hervey <bilboed@bilboed.com> | 2017-12-01 10:02:03 +0100 |
| commit | b850160084ca30018f3c75fc0d56b21d3f088f00 (patch) | |
| tree | d69537fa43806fcb154cd32710b523bc5a38bfd4 | |
| parent | bcce26eb7e5177d494d382cdcc5787d0b3beddd1 (diff) | |
| download | gstreamer-plugins-base-b850160084ca30018f3c75fc0d56b21d3f088f00.tar.gz | |
typefind: Fix out-of-bound read in PNM typefinder
| -rw-r--r-- | gst/typefind/gsttypefindfunctions.c | 13 |
1 files changed, 11 insertions, 2 deletions
diff --git a/gst/typefind/gsttypefindfunctions.c b/gst/typefind/gsttypefindfunctions.c index 60e8d066f..76dbb461c 100644 --- a/gst/typefind/gsttypefindfunctions.c +++ b/gst/typefind/gsttypefindfunctions.c @@ -4054,15 +4054,24 @@ pnm_type_find (GstTypeFind * tf, gpointer ununsed) /* need to skip any comment lines first */ data_scan_ctx_advance (tf, &c, 3); + + if (!data_scan_ctx_ensure_data (tf, &c, 1)) + return; + while (c.data[0] == '#') { /* we know there's still data left */ data_scan_ctx_advance (tf, &c, 1); + if (!data_scan_ctx_ensure_data (tf, &c, 1)) + return; + while (c.data[0] != '\n' && c.data[0] != '\r') { - if (!data_scan_ctx_ensure_data (tf, &c, 4)) - return; data_scan_ctx_advance (tf, &c, 1); + if (!data_scan_ctx_ensure_data (tf, &c, 1)) + return; } data_scan_ctx_advance (tf, &c, 1); GST_LOG ("skipped comment line in PNM header"); + if (!data_scan_ctx_ensure_data (tf, &c, 1)) + return; } if (!data_scan_ctx_ensure_data (tf, &c, 32) && |