ogg: Fix a heap buffer overflow.

Reported by: An anonymous contributor working with the SecuriTeam Secure
Disclosure
program (http://www.beyondsecurity.com/ssd.html)

diff --git a/modules/demux/ogg.c b/modules/demux/ogg.c
index bb693d18e65f5883dbb4bcd482796a30a9ecc047..65f4a44eff7360dc11d36776a17edb2566079e71 100644 (file)
--- a/modules/demux/ogg.c
+++ b/modules/demux/ogg.c
@@ -640,7 +640,7 @@ static void Ogg_DecodePacket( demux_t *p_demux,
             if( p_stream->p_headers )
             {
                 memcpy( (unsigned char *)p_stream->p_headers + p_stream->i_headers - p_oggpacket->bytes,
-                        p_oggpacket->packet, p_stream->i_headers );
+                        p_oggpacket->packet, p_oggpacket->bytes );
             }
             else
             {