CVE:CVE-2008-1482
CNNVD:CNNVD-200803-391
xine是一款免费的媒体播放器，支持多种格式。
xine在计算某些目标缓冲区和数组所需分配的内存数时错误的32位计算，导致xine-lib受多个堆溢出漏洞影响，可能允许攻击者控制寄存器和代码流。
以下是有漏洞的代码部分：
-----------------------------
A] demux_flv堆溢出
-----------------------------
src/demuxers/demux_flv.c：
static int parse_flv_var(demux_flv_t *this, 
                         unsigned char *buf, int size, char *key, int keylen) {
          ...
          this->index = xine_xmalloc(num*sizeof(flv_index_entry_t));
          ...
          this->index = xine_xmalloc(num*sizeof(flv_index_entry_t));
----------------------------
B] demux_qt堆溢出
----------------------------
src/demuxers/demux_qt.c中几乎所有的分配指令都存在堆溢出。
------------------------------
C] demux_real堆溢出
------------------------------
src/demuxers/demux_real.c：
static void real_parse_index(demux_real_t *this) {
        ...
        *index = xine_xmalloc(entries * sizeof(real_index_entry_t));
----------------------------------
D] demux_wc3movie堆溢出
----------------------------------
src/demuxers/demux_wc3movie.c：
static int open_mve_file(demux_mve_t *this) {
  ...
  this->palettes = xine_xmalloc(this->number_of_shots * PALETTE_SIZE *
    sizeof(palette_entry_t));
------------------------
E] ebml堆溢出
------------------------
src/demuxers/ebml.c：
int ebml_check_header(ebml_parser_t *ebml) {
        ...
        char *text = malloc(elem.len + 1);
------------------------------
F] demux_film堆溢出
------------------------------
src/demuxers/demux_film.c：
static int open_film_file(demux_film_t *film) {
      ...
      film->sample_table =
        xine_xmalloc(film->sample_count * sizeof(film_sample_t));
solution:Upgrade xine xine-lib to a higher version than 1.1.11,and avoid the version 1.1.11