diff options
| author | Max Kellermann <max@duempel.org> | 2008-08-26 08:27:11 +0200 |
|---|---|---|
| committer | Max Kellermann <max@duempel.org> | 2008-08-26 08:27:11 +0200 |
| commit | 351dda01bd48061089883511d532926d425cd447 (patch) | |
| tree | 836d390a89da980af375abcbab1f591c9ee20822 | |
| parent | 9131f9ebfe9fe81c30b5bed62e4d86ec805ca740 (diff) | |
| download | mpd-351dda01bd48061089883511d532926d425cd447.tar.gz mpd-351dda01bd48061089883511d532926d425cd447.tar.xz mpd-351dda01bd48061089883511d532926d425cd447.zip | |
aac: check buffer lengths
The AAC plugin sometimes does not check the length of available data
when checking for magic prefixes. Add length checks.
Diffstat (limited to '')
| -rw-r--r-- | src/inputPlugins/aac_plugin.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/src/inputPlugins/aac_plugin.c b/src/inputPlugins/aac_plugin.c index b48d985b4..7a9137603 100644 --- a/src/inputPlugins/aac_plugin.c +++ b/src/inputPlugins/aac_plugin.c @@ -196,7 +196,7 @@ static void initAacBuffer(InputStream * inStream, AacBuffer * b, float *length) fillAacBuffer(b); tagsize = 0; - if (!memcmp(b->buffer, "ID3", 3)) { + if (b->bytesIntoBuffer >= 10 && !memcmp(b->buffer, "ID3", 3)) { tagsize = (b->buffer[6] << 21) | (b->buffer[7] << 14) | (b->buffer[8] << 7) | (b->buffer[9] << 0); @@ -208,7 +208,8 @@ static void initAacBuffer(InputStream * inStream, AacBuffer * b, float *length) if (length == NULL) return; - if ((b->buffer[0] == 0xFF) && ((b->buffer[1] & 0xF6) == 0xF0)) { + if (b->bytesIntoBuffer >= 2 && + (b->buffer[0] == 0xFF) && ((b->buffer[1] & 0xF6) == 0xF0)) { adtsParse(b, length); seekInputStream(b->inStream, tagsize, SEEK_SET); |