aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMax Kellermann <max@duempel.org>2008-08-26 08:27:11 +0200
committerMax Kellermann <max@duempel.org>2008-08-26 08:27:11 +0200
commit351dda01bd48061089883511d532926d425cd447 (patch)
tree836d390a89da980af375abcbab1f591c9ee20822
parent9131f9ebfe9fe81c30b5bed62e4d86ec805ca740 (diff)
downloadmpd-351dda01bd48061089883511d532926d425cd447.tar.gz
mpd-351dda01bd48061089883511d532926d425cd447.tar.xz
mpd-351dda01bd48061089883511d532926d425cd447.zip
aac: check buffer lengths
The AAC plugin sometimes does not check the length of available data when checking for magic prefixes. Add length checks.
Diffstat (limited to '')
-rw-r--r--src/inputPlugins/aac_plugin.c5
1 files changed, 3 insertions, 2 deletions
diff --git a/src/inputPlugins/aac_plugin.c b/src/inputPlugins/aac_plugin.c
index b48d985b4..7a9137603 100644
--- a/src/inputPlugins/aac_plugin.c
+++ b/src/inputPlugins/aac_plugin.c
@@ -196,7 +196,7 @@ static void initAacBuffer(InputStream * inStream, AacBuffer * b, float *length)
fillAacBuffer(b);
tagsize = 0;
- if (!memcmp(b->buffer, "ID3", 3)) {
+ if (b->bytesIntoBuffer >= 10 && !memcmp(b->buffer, "ID3", 3)) {
tagsize = (b->buffer[6] << 21) | (b->buffer[7] << 14) |
(b->buffer[8] << 7) | (b->buffer[9] << 0);
@@ -208,7 +208,8 @@ static void initAacBuffer(InputStream * inStream, AacBuffer * b, float *length)
if (length == NULL)
return;
- if ((b->buffer[0] == 0xFF) && ((b->buffer[1] & 0xF6) == 0xF0)) {
+ if (b->bytesIntoBuffer >= 2 &&
+ (b->buffer[0] == 0xFF) && ((b->buffer[1] & 0xF6) == 0xF0)) {
adtsParse(b, length);
seekInputStream(b->inStream, tagsize, SEEK_SET);