virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-07-11 14:30:22 +02:00
Code Issues Releases Activity

lavf/mxfdec: Remove a call to avio_tell() in klv_read_packet()

Browse Source
This commit is contained in:
Tomas Härdin
2024-09-15 22:46:55 +02:00
parent 649ac17efd
commit 25d605d080
1 changed files with 14 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
libavformat/mxfdec.c
View File

@ -429,7 +429,7 @@ static void mxf_free_metadataset(MXFMetadataSet **ctx, enum MXFMetadataSetType t
av_freep(ctx); av_freep(ctx);
} }
static int64_t klv_decode_ber_length(AVIOContext *pb) static int64_t klv_decode_ber_length(AVIOContext *pb, int *llen)
{ {
uint64_t size = avio_r8(pb); uint64_t size = avio_r8(pb);
if (size & 0x80) { /* long form */ if (size & 0x80) { /* long form */
@ -437,9 +437,13 @@ static int64_t klv_decode_ber_length(AVIOContext *pb)
/* SMPTE 379M 5.3.4 guarantee that bytes_num must not exceed 8 bytes */ /* SMPTE 379M 5.3.4 guarantee that bytes_num must not exceed 8 bytes */
if (bytes_num > 8) if (bytes_num > 8)
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
if (llen)
*llen = bytes_num + 1;
size = 0; size = 0;
while (bytes_num--) while (bytes_num--)
size = size << 8 | avio_r8(pb); size = size << 8 | avio_r8(pb);
} else if (llen) {
*llen = 1;
} }
if (size > INT64_MAX) if (size > INT64_MAX)
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
@ -478,6 +482,8 @@ static int mxf_read_sync_klv(AVIOContext *pb)
static int klv_read_packet(MXFContext *mxf, KLVPacket *klv, AVIOContext *pb) static int klv_read_packet(MXFContext *mxf, KLVPacket *klv, AVIOContext *pb)
{ {
int64_t length, pos; int64_t length, pos;
int llen;
if (!mxf_read_sync_klv(pb)) if (!mxf_read_sync_klv(pb))
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
klv->offset = avio_tell(pb) - 4; klv->offset = avio_tell(pb) - 4;
@ -486,11 +492,11 @@ static int klv_read_packet(MXFContext *mxf, KLVPacket *klv, AVIOContext *pb)
memcpy(klv->key, mxf_klv_key, 4); memcpy(klv->key, mxf_klv_key, 4);
avio_read(pb, klv->key + 4, 12); avio_read(pb, klv->key + 4, 12);
length = klv_decode_ber_length(pb); length = klv_decode_ber_length(pb, &llen);
if (length < 0) if (length < 0)
return length; return length;
klv->length = length; klv->length = length;
pos = avio_tell(pb); pos = klv->offset + 16 + llen;
if (pos > INT64_MAX - length) if (pos > INT64_MAX - length)
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
klv->next_klv = pos + length; klv->next_klv = pos + length;
@ -661,15 +667,15 @@ static int mxf_decrypt_triplet(AVFormatContext *s, AVPacket *pkt, KLVPacket *klv
av_aes_init(mxf->aesc, s->key, 128, 1); av_aes_init(mxf->aesc, s->key, 128, 1);
} }
// crypto context // crypto context
size = klv_decode_ber_length(pb); size = klv_decode_ber_length(pb, NULL);
if (size < 0) if (size < 0)
return size; return size;
avio_skip(pb, size); avio_skip(pb, size);
// plaintext offset // plaintext offset
klv_decode_ber_length(pb); klv_decode_ber_length(pb ,NULL);
plaintext_size = avio_rb64(pb); plaintext_size = avio_rb64(pb);
// source klv key // source klv key
klv_decode_ber_length(pb); klv_decode_ber_length(pb, NULL);
avio_read(pb, klv->key, 16); avio_read(pb, klv->key, 16);
if (!IS_KLV_KEY(klv, mxf_essence_element_key)) if (!IS_KLV_KEY(klv, mxf_essence_element_key))
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
@ -679,12 +685,12 @@ static int mxf_decrypt_triplet(AVFormatContext *s, AVPacket *pkt, KLVPacket *klv
if (index < 0) if (index < 0)
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
// source size // source size
klv_decode_ber_length(pb); klv_decode_ber_length(pb, NULL);
orig_size = avio_rb64(pb); orig_size = avio_rb64(pb);
if (orig_size < plaintext_size) if (orig_size < plaintext_size)
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
// enc. code // enc. code
size = klv_decode_ber_length(pb); size = klv_decode_ber_length(pb, NULL);
if (size < 32 || size - 32 < orig_size || (int)orig_size != orig_size) if (size < 32 || size - 32 < orig_size || (int)orig_size != orig_size)
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
avio_read(pb, ivec, 16); avio_read(pb, ivec, 16);