[SCM] libav/experimental: check fragment offset and size yes this too could have been exploitable ...

[siretart at users.alioth.debian.org]

The following commit has been merged in the experimental branch:
commit 4c71d7270104ce148faa2e44237450a9d303de96
Author: Michael Niedermayer <michaelni at gmx.at>
Date:   Mon Jan 22 16:37:45 2007 +0000

    check fragment offset and size
    yes this too could have been exploitable ...
    
    Originally committed as revision 7650 to svn://svn.ffmpeg.org/ffmpeg/trunk

diff --git a/libavformat/asf.c b/libavformat/asf.c
index fc3a7de..ef7ae5e 100644
--- a/libavformat/asf.c
+++ b/libavformat/asf.c
@@ -703,6 +703,14 @@ static int asf_read_packet(AVFormatContext *s, AVPacket *pkt)
         asf->packet_size_left -= asf->packet_frag_size;
         if (asf->packet_size_left < 0)
             continue;
+
+        if(   asf->packet_frag_offset >= asf_st->pkt.size
+           || asf->packet_frag_size > asf_st->pkt.size - asf->packet_frag_offset){
+            av_log(s, AV_LOG_ERROR, "packet fragment position invalid %u,%u not in %u\n",
+                asf->packet_frag_offset, asf->packet_frag_size, asf_st->pkt.size);
+            continue;
+        }
+
         get_buffer(pb, asf_st->pkt.data + asf->packet_frag_offset,
                    asf->packet_frag_size);
         asf_st->frag_offset += asf->packet_frag_size;
diff --git a/libavformat/asf.h b/libavformat/asf.h
index 0aabe79..457f92d 100644
--- a/libavformat/asf.h
+++ b/libavformat/asf.h
@@ -106,8 +106,8 @@ typedef struct {
     int packet_replic_size;
     int packet_key_frame;
     int packet_padsize;
-    int packet_frag_offset;
-    int packet_frag_size;
+    unsigned int packet_frag_offset;
+    unsigned int packet_frag_size;
     int packet_frag_timestamp;
     int packet_multi_size;
     int packet_obj_size;

-- 
Libav/FFmpeg packaging