roytam1/palemoon27
1
0
Fork 0
mirror of https://github.com/roytam1/palemoon27.git synced 2026-06-01 00:09:57 +00:00
Code Issues Projects Releases Wiki Activity

Ensure we don't attempt to process garbage data

Browse Source
This commit is contained in:
trav90
2017-05-04 02:34:33 -05:00
committed by roytam1
parent 26cd7523aa
commit c3330e6c8a
2 changed files with 12 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
dom/media/mediasource/TrackBuffersManager.cpp
+11 -2
View File
@@ -692,13 +692,22 @@ void
TrackBuffersManager::InitializationSegmentReceived()
{
MOZ_ASSERT(mParser->HasCompleteInitData());
int64_t endInit = mParser->InitSegmentRange().mEnd;
if (mInputBuffer->Length() > mProcessedInput ||
int64_t(mProcessedInput - mInputBuffer->Length()) > endInit) {
// Something is not quite right with the data appended. Refuse it.
RejectAppend(NS_ERROR_FAILURE, __func__);
return;
}
mCurrentInputBuffer = new SourceBufferResource(mType);
mCurrentInputBuffer->AppendData(mParser->InitData());
uint32_t length =
mParser->InitSegmentRange().mEnd - (mProcessedInput - mInputBuffer->Length());
uint32_t length = endInit - (mProcessedInput - mInputBuffer->Length());
if (mInputBuffer->Length() == length) {
mInputBuffer = nullptr;
} else {
MOZ_RELEASE_ASSERT(length <= mInputBuffer->Length());
mInputBuffer->RemoveElementsAt(0, length);
}
CreateDemuxerforMIMEType();
dom/media/mediasource/TrackBuffersManager.h
+1 -1
View File
@@ -145,7 +145,7 @@ private:
nsRefPtr<SourceBufferResource> mCurrentInputBuffer;
nsRefPtr<MediaDataDemuxer> mInputDemuxer;
// Length already processed in current media segment.
uint32_t mProcessedInput;
uint64_t mProcessedInput;
void OnDemuxerInitDone(nsresult);
void OnDemuxerInitFailed(DemuxerFailureReason aFailure);