From: Chris Evans <cevans@chromium.org>
Date: Wed, 20 Jul 2011 00:51:48 +0000 (-0700)
Subject: matroskadec: fix integer underflow if header length < probe length.
X-Git-Tag: v0.8b1~1952
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=69619a13c3fef940cba545cf0a283ff22771dd71;p=platform%2Fupstream%2Flibav.git

matroskadec: fix integer underflow if header length < probe length.

This fixes a crash with specifically crafted files.

Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>
---

diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c
index 852760c..0379977 100644
--- a/libavformat/matroskadec.c
+++ b/libavformat/matroskadec.c
@@ -903,6 +903,8 @@ static int matroska_probe(AVProbeData *p)
      * Not fully fool-proof, but good enough. */
     for (i = 0; i < FF_ARRAY_ELEMS(matroska_doctypes); i++) {
         int probelen = strlen(matroska_doctypes[i]);
+        if (total < probelen)
+            continue;
         for (n = 4+size; n <= 4+size+total-probelen; n++)
             if (!memcmp(p->buf+n, matroska_doctypes[i], probelen))
                 return AVPROBE_SCORE_MAX;