Skip to content

Commit ead726b

Browse files
committed
Don't limit CodecPrivate to 256KB
1 parent 2f4cf7c commit ead726b

File tree

1 file changed

+15
-3
lines changed

1 file changed

+15
-3
lines changed

src/core/matroskaparser.c

Lines changed: 15 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -159,6 +159,8 @@ struct MatroskaFile {
159159
int bufpos; // current read position in buffer
160160
int buflen; // valid bytes in buffer
161161

162+
void *cpbuf;
163+
162164
// error reporting
163165
char errmsg[128];
164166
jmp_buf jb;
@@ -415,6 +417,9 @@ static void myvsnprintf(char *dest,unsigned dsize,const char *fmt,va_list ap)
415417
static void errorjmp(MatroskaFile *mf,const char *fmt, ...) {
416418
va_list ap;
417419

420+
mf->cache->memfree(mf->cache, mf->cpbuf);
421+
mf->cpbuf = NULL;
422+
418423
va_start(ap, fmt);
419424
myvsnprintf(mf->errmsg,sizeof(mf->errmsg),fmt,ap);
420425
va_end(ap);
@@ -1373,10 +1378,14 @@ static void parseTrackEntry(MatroskaFile *mf,ulonglong toplen) {
13731378
case 0x63a2: // CodecPrivate
13741379
if (cp)
13751380
errorjmp(mf,"Duplicate CodecPrivate");
1376-
if (len>262144) // 256KB
1377-
errorjmp(mf,"CodecPrivate is too large: %d",(int)len);
13781381
cplen = (unsigned)len;
1379-
cp = alloca(cplen);
1382+
if (len > 262144) { // 256KB
1383+
cp = mf->cpbuf = mf->cache->memalloc(mf->cache, cplen);
1384+
if (!cp)
1385+
errorjmp(mf,"Out of memory");
1386+
}
1387+
else
1388+
cp = alloca(cplen);
13801389
readbytes(mf,cp,(int)cplen);
13811390
break;
13821391
case 0x258688: // CodecName
@@ -1557,9 +1566,12 @@ static void parseTrackEntry(MatroskaFile *mf,ulonglong toplen) {
15571566

15581567
static void parseTracks(MatroskaFile *mf,ulonglong toplen) {
15591568
mf->seen.Tracks = 1;
1569+
mf->cpbuf = NULL;
15601570
FOREACH(mf,toplen)
15611571
case 0xae: // TrackEntry
15621572
parseTrackEntry(mf,len);
1573+
mf->cache->memfree(mf->cache, mf->cpbuf);
1574+
mf->cpbuf = NULL;
15631575
break;
15641576
ENDFOR(mf);
15651577
}

0 commit comments

Comments
 (0)