GNOME Bugzilla – Bug 590622
[bytereader] buffer size checks subject to wrap-around overflow
Last modified: 2009-08-03 19:15:20 UTC
GstByteReader functions check whether there is enough data for requested item, typically with a fragment as follows: if (reader->byte + size > reader->size) return FALSE; However, if size and/or current byte position are sufficiently large, wrap-around might make it seems sufficient data is still available, while not really so.
Created attachment 139783 [details] [review] Patch buffer size checks Use slightly different check on buffer size availability to avoid wrap-around (using the constraint that reader->byte <= reader->size).
Looks good... good catch :)
Could we please get this in for the release? Should be straight-forward enough, and is needed so code in plugin modules can rely on GstByteReader to do proper bounds checking.
Please commit...
commit eeb6d810bcf989b1daff599d03aeb19066729b17 Author: Mark Nauwelaerts <mark.nauwelaerts@collabora.co.uk> Date: Mon Aug 3 15:31:22 2009 +0200 bytereader: avoid wrap-around in buffer size checks. Fixes #590622.