From: jstebbins <jstebbins@b64f7644-9d1e-0410-96f1-a4d463321fa5>
Date: Sat, 27 Jun 2009 20:29:50 +0000 (+0000)
Subject: libdvdread: patch libdvdread malloc bomb
X-Git-Url: http://git.osdn.jp/view?a=commitdiff_plain;ds=sidebyside;h=e7dd68879ed38eafabfab925b1bb81990ff8c628;hp=722be02e829ad969250d1604e57ec8b9846dc060;p=handbrake-jp%2Fhandbrake-jp-git.git

libdvdread: patch libdvdread malloc bomb
if pgci_ut->nr_of_lus is an invalid value, libdvdread can malloc GB of data
while attempting to parse invalid data


git-svn-id: svn://localhost/HandBrake/trunk@2637 b64f7644-9d1e-0410-96f1-a4d463321fa5
---

diff --git a/contrib/libdvdread/A01-check-nr_of_lus.patch b/contrib/libdvdread/A01-check-nr_of_lus.patch
new file mode 100644
index 00000000..d49fb949
--- /dev/null
+++ b/contrib/libdvdread/A01-check-nr_of_lus.patch
@@ -0,0 +1,17 @@
+diff -Naur libdvdread.orig/src/ifo_read.c libdvdread/src/ifo_read.c
+--- libdvdread.orig/src/ifo_read.c	2009-01-08 14:57:10.000000000 -0800
++++ libdvdread/src/ifo_read.c	2009-06-27 13:22:27.940241400 -0700
+@@ -1914,6 +1914,13 @@
+   CHECK_VALUE(pgci_ut->nr_of_lus < 100); /* ?? 3-4 ? */
+   CHECK_VALUE((uint32_t)pgci_ut->nr_of_lus * PGCI_LU_SIZE < pgci_ut->last_byte);
+ 
++  if (pgci_ut->nr_of_lus == 0 || pgci_ut->nr_of_lus >= 100)
++  {
++    free(pgci_ut);
++    ifofile->pgci_ut = 0;
++    return 0;
++  }
++
+   info_length = pgci_ut->nr_of_lus * PGCI_LU_SIZE;
+   data = malloc(info_length);
+   if(!data) {