Matroska demuxer was miscalculating the lace sizes for fixed-size lacing

CVS patchset: 7841
CVS date: 2006/01/24 21:59:13

2 files changed, 12 insertions, 6 deletions

diff --git a/ChangeLog b/ChangeLog
index e39a425b1..64bc30ed6 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -4,6 +4,7 @@ xine-lib (1.1.2)
   * Also look for Xv support in /usr/lib for X.org's new location
   * Fix using xine-lib on systems with SELinux enabled
   * Build right with libiconv in /usr/local as default on FreeBSD
+  * Fix a potential crash with fixed-size lacing in the Matroska demuxer
 
 xine-lib (1.1.1)
   * Improve sound quality when using alsa 1.0.9 or above.
diff --git a/src/demuxers/demux_matroska.c b/src/demuxers/demux_matroska.c
index ad2ca7729..fdc6fb7a8 100644
--- a/src/demuxers/demux_matroska.c
+++ b/src/demuxers/demux_matroska.c
@@ -17,7 +17,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA
  *
- * $Id: demux_matroska.c,v 1.41 2005/11/28 12:24:57 valtri Exp $
+ * $Id: demux_matroska.c,v 1.42 2006/01/24 21:59:13 molivier Exp $
  *
  * demultiplexer for matroska streams
  *
@@ -1765,14 +1765,19 @@ static int parse_block (demux_matroska_t *this, uint64_t block_size,
       }
       break;
 
-      case MATROSKA_FIXED_SIZE_LACING:
+      case MATROSKA_FIXED_SIZE_LACING: {
+        int frame_size;
+
         lprintf("fixed size lacing\n");
+        
+        frame_size = block_size_left / (lace_num + 1);
         for (i = 0; i < lace_num; i++) {
-          frame[i] = block_size / (lace_num + 1);
-          block_size_left -= frame[i];
+          frame[i] = frame_size;
         }
-        frame[lace_num] = block_size_left;
-        break;
+        frame[lace_num] = block_size_left - (lace_num * frame_size);
+        block_size_left = 0;
+      }
+      break;
 
       case MATROSKA_EBML_LACING: {
         int64_t tmp;