matroskadec: fix crash when parsing invalid mkv

Message ID 20150418144950.E9F095DE07@aruru.libav.org
State New
Headers show

Commit Message

Janne Grunau April 18, 2015, 2:49 p.m.
Module: libav
Branch: master
Commit: b8d7f3186e86234f6255f5e8ee9e98573b4d9a6e

Author:    Thomas Guillem <thomas@gllm.fr>
Committer: Anton Khirnov <anton@khirnov.net>
Date:      Fri Apr 10 19:04:51 2015 +0200

matroskadec: fix crash when parsing invalid mkv

CC: libav-stable@libav.org

Signed-off-by: Anton Khirnov <anton@khirnov.net>

---

 libavformat/matroskadec.c |    8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

Patch

diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c
index 7dac7be..93cd4bb 100644
--- a/libavformat/matroskadec.c
+++ b/libavformat/matroskadec.c
@@ -1827,8 +1827,12 @@  static int matroska_read_header(AVFormatContext *s)
     matroska->ctx = s;
 
     /* First read the EBML header. */
-    if (ebml_parse(matroska, ebml_syntax, &ebml) ||
-        ebml.version         > EBML_VERSION      ||
+    if (ebml_parse(matroska, ebml_syntax, &ebml) || !ebml.doctype) {
+        av_log(matroska->ctx, AV_LOG_ERROR, "EBML header parsing failed\n");
+        ebml_free(ebml_syntax, &ebml);
+        return AVERROR_INVALIDDATA;
+    }
+    if (ebml.version         > EBML_VERSION      ||
         ebml.max_size        > sizeof(uint64_t)  ||
         ebml.id_length       > sizeof(uint32_t)  ||
         ebml.doctype_version > 3) {