Original commit message from CVS:
Add buffer length checks to every typefinding function
static GstCaps*
dv_type_find (GstBuffer *buf, gpointer private)
{
- guint32 head = GUINT32_FROM_BE(*((guint32 *)GST_BUFFER_DATA(buf)));
+ guint32 head;
GstCaps *new = NULL;
+ if (GST_BUFFER_SIZE (buf) < 5)
+ return NULL;
+
+ head = GUINT32_FROM_BE(*((guint32 *)GST_BUFFER_DATA(buf)));
+
/* check for DIF and DV flag */
if ((head & 0xffffff00) == 0x1f070000 && !(GST_BUFFER_DATA(buf)[4] & 0x01)) {
gchar *format;
static GstCaps*
flac_type_find (GstBuffer *buf, gpointer private)
{
- guint32 head = GUINT32_FROM_BE (*((guint32 *)GST_BUFFER_DATA (buf)));
+ guint32 head;
+
+ if (GST_BUFFER_SIZE (buf) < 4)
+ return NULL;
+ head = GUINT32_FROM_BE (*((guint32 *)GST_BUFFER_DATA (buf)));
if (head != 0x664C6143)
return NULL;
GstCaps *new = NULL;
gulong *head = (gulong *) GST_BUFFER_DATA (buf);
+ if (GST_BUFFER_SIZE (buf) < 4)
+ return NULL;
+
if (*head == 0x2e736e64 || *head == 0x646e732e)
new = gst_caps_new ("au_type_find", "audio/au", NULL);
GST_DEBUG ("avi_demux: typefind");
+ if (GST_BUFFER_SIZE (buf) < 12)
+ return NULL;
+
if (GUINT32_FROM_LE (((guint32 *)data)[0]) != GST_RIFF_TAG_RIFF)
return NULL;
if (GUINT32_FROM_LE (((guint32 *)data)[2]) != GST_RIFF_RIFF_AVI)