avformat/s337m: fix potentially undefined pointer arithmetic

Use integer position instead of pointer for loop variable. Also only skip header fields after header has been fully validated.

foo86 committed 9 years ago

Commit 6029b8a1 parent 5e715b51 file · +10 −10Browse files

Unified · Split

@@ -86,22 +86,21 @@ static int s337m_probe(AVProbeData *p) · 85 unmodified lines
86	86	{
87	87	uint64_t state = 0;
88	88	int markers[3] = { 0 };
89		− int i, sum, max, data_type, data_size, offset;
	89	+ int i, pos, sum, max, data_type, data_size, offset;
90	90	uint8_t *buf;
91	91
92		− for (buf = p->buf; buf < p->buf + p->buf_size; buf++) {
93		− state = (state << 8) \| *buf;
	92	+ for (pos = 0; pos < p->buf_size; pos++) {
	93	+ state = (state << 8) \| p->buf[pos];
94	94	if (!IS_LE_MARKER(state))
95	95	continue;
96	96
	97	+ buf = p->buf + pos + 1;
97	98	if (IS_16LE_MARKER(state)) {
98		− data_type = AV_RL16(buf + 1);
99		− data_size = AV_RL16(buf + 3);
100		− buf += 4;
	99	+ data_type = AV_RL16(buf );
	100	+ data_size = AV_RL16(buf + 2);
101	101	} else {
102		− data_type = AV_RL24(buf + 1);
103		− data_size = AV_RL24(buf + 4);
104		− buf += 6;
	102	+ data_type = AV_RL24(buf );
	103	+ data_size = AV_RL24(buf + 3);
105	104	}
106	105
107	106	if (s337m_get_offset_and_codec(NULL, state, data_type, data_size, &offset, NULL))
@@ -110,7 +109,8 @@ static int s337m_probe(AVProbeData *p) · 2 unmodified lines
110	109	i = IS_16LE_MARKER(state) ? 0 : IS_20LE_MARKER(state) ? 1 : 2;
111	110	markers[i]++;
112	111
113		− buf += offset;
	112	+ pos += IS_16LE_MARKER(state) ? 4 : 6;
	113	+ pos += offset;
114	114	state = 0;
115	115	}
116	116

Keyboard shortcuts