Re: [xine-devel] [PATCH] Additional check to fix potentiel crash in xine-engine/demux.c

[Thibaut M. <thi...@gm...>]

Hi Mathieu,

On 1/6/06, Mathieu Olivier <mol...@us...> wrote:
> Hello.
>
> I crashed Xine-UI a couple of weeks ago while trying to play a MKV
> movie. I finally got the time to compile a debug version of Xine-lib
> this morning, and found the crash was due to the Matroska demuxer
> passing a negative size value to the "_x_demux_send_data" function (in
> xine-engine/demux.c).
>
> I'm still working on this bug to find the actual problem in the MKV
> demuxer (why it passes a negative size), but in the mean time I thought
> it would be a good thing to hardened the check of the size parameter a
> bit in "_x_demux_send_data". As a matter of fact, it fixes my problem:
> the movie plays correctly with this attached patch.

_x_demux_send_data is used at 3 places, have you found which call
passes a negative value ?


> PS: the patch was made against xine-lib 1.1.1.

The patch hides the bug, IMHO "_x_assert(size > 0)" is better.

Thibaut

> --
> Mathieu Olivier  <mol...@us...>
>
>
> --- xine-lib-1.1.1.orig/src/xine-engine/demux.c 2005-10-30 03:18:35.00000=
0000 +0100
> +++ xine-lib-1.1.1/src/xine-engine/demux.c      2006-01-06 08:21:38.00000=
0000 +0100
> @@ -525,7 +525,7 @@
>
>    decoder_flags |=3D BUF_FLAG_FRAME_START;
>
> -  while (fifo && size) {
> +  while (fifo && size > 0) {
>
>      buf =3D fifo->buffer_pool_alloc (fifo);