Fix out-of-bound read uncovered by sam

diff --git a/modules/demux/avi/libavi.c b/modules/demux/avi/libavi.c
index 5978484ac86d329c550c1528574af50e9de2ed07..40ace553d01911e1e93fac6efdf6949cca2ec5b9 100644 (file)
--- a/modules/demux/avi/libavi.c
+++ b/modules/demux/avi/libavi.c
@@ -210,38 +210,38 @@ static int AVI_ChunkRead_list( stream_t *s, avi_chunk_t *p_container )
     p_read += 8; \
     i_read -= 8
 
+#define AVI_READ( res, func, size ) \
+    if( i_read < size ) { \
+        free( p_buff); \
+        return VLC_EGENERIC; \
+    } \
+    i_read -= size; \
+    res = func( p_read ); \
+    p_read += size \
+
 #define AVI_READCHUNK_EXIT( code ) \
     free( p_buff ); \
-    if( i_read < 0 ) \
-    { \
-        msg_Warn( (vlc_object_t*)s, "not enough data" ); \
-    } \
     return code
 
+static inline uint8_t GetB( uint8_t *ptr )
+{
+    return *ptr;
+}
+
 #define AVI_READ1BYTE( i_byte ) \
-    i_byte = *p_read; \
-    p_read++; \
-    i_read--
+    AVI_READ( i_byte, GetB, 1 )
 
 #define AVI_READ2BYTES( i_word ) \
-    i_word = GetWLE( p_read ); \
-    p_read += 2; \
-    i_read -= 2
+    AVI_READ( i_word, GetWLE, 2 )
 
 #define AVI_READ4BYTES( i_dword ) \
-    i_dword = GetDWLE( p_read ); \
-    p_read += 4; \
-    i_read -= 4
+    AVI_READ( i_dword, GetDWLE, 4 )
 
-#define AVI_READ8BYTES( i_dword ) \
-    i_dword = GetQWLE( p_read ); \
-    p_read += 8; \
-    i_read -= 8
+#define AVI_READ8BYTES( i_qword ) \
+    AVI_READ( i_qword, GetQWLE, 8 )
 
 #define AVI_READFOURCC( i_dword ) \
-    i_dword = GetFOURCC( p_read ); \
-    p_read += 4; \
-    i_read -= 4
+    AVI_READ( i_dword, GetFOURCC, 4 )
 
 static int AVI_ChunkRead_avih( stream_t *s, avi_chunk_t *p_chk )
 {

diff --git a/src/misc/modules.c b/src/misc/modules.c
index 701463cff69b4e9cdd08f0ae641f8e3cfea847e5..cf46740600a9775917af17f759c0c6673b3448c3 100644 (file)
--- a/src/misc/modules.c
+++ b/src/misc/modules.c
@@ -1447,7 +1447,7 @@ static void CloseModule( module_handle_t handle )
     FreeLibrary( handle );
 
 #elif defined(HAVE_DL_DLOPEN)
-    dlclose( handle );
+    //dlclose( handle );
 
 #elif defined(HAVE_DL_SHL_LOAD)
     shl_unload( handle );