[FFmpeg-cvslog] r23756 - trunk/libavformat/asfdec.c

[mru]

Author: mru
Date: Thu Jun 24 17:10:06 2010
New Revision: 23756

Log:
asfdec: ensure number of streams is within bounds; remove VLA in asf_read_pts()

Modified:
   trunk/libavformat/asfdec.c

Modified: trunk/libavformat/asfdec.c
==============================================================================
--- trunk/libavformat/asfdec.c	Thu Jun 24 11:42:34 2010	(r23755)
+++ trunk/libavformat/asfdec.c	Thu Jun 24 17:10:06 2010	(r23756)
@@ -35,6 +35,7 @@ void ff_mms_set_stream_selection(URLCont
 #undef NDEBUG
 #include <assert.h>
 
+#define ASF_MAX_STREAMS 127
 #define FRAME_HEADER_SIZE 17
 // Fix Me! FRAME_HEADER_SIZE may be different.
 
@@ -244,6 +245,11 @@ static int asf_read_header(AVFormatConte
             int64_t pos1, pos2, start_time;
             int test_for_ext_stream_audio, is_dvr_ms_audio=0;
 
+            if (s->nb_streams == ASF_MAX_STREAMS) {
+                av_log(s, AV_LOG_ERROR, "too many streams\n");
+                return AVERROR(EINVAL);
+            }
+
             pos1 = url_ftell(pb);
 
             st = av_new_stream(s, 0);
@@ -1053,7 +1059,7 @@ static int64_t asf_read_pts(AVFormatCont
     int64_t pts;
     int64_t pos= *ppos;
     int i;
-    int64_t start_pos[s->nb_streams];
+    int64_t start_pos[ASF_MAX_STREAMS];
 
     for(i=0; i<s->nb_streams; i++){
         start_pos[i]= pos;