virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-08-10 06:10:52 +02:00
Code Issues Releases Activity

utils: Check for extradata size overflows.

Browse Source
This commit is contained in:
Alex Converse
2012-01-12 11:12:24 -08:00
parent 81dc6a2a3c
commit 4df30f7114
3 changed files with 13 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
libavcodec/internal.h
View File

@@ -94,4 +94,11 @@ unsigned int avpriv_toupper4(unsigned int x);
int avpriv_lock_avformat(void); int avpriv_lock_avformat(void);
int avpriv_unlock_avformat(void); int avpriv_unlock_avformat(void);
/**
* Maximum size in bytes of extradata.
* This value was chosen such that every bit of the buffer is
* addressable by a 32-bit signed integer as used by get_bits.
*/
#define FF_MAX_EXTRADATA_SIZE ((1 << 28) - FF_INPUT_BUFFER_PADDING_SIZE)
#endif /* AVCODEC_INTERNAL_H */ #endif /* AVCODEC_INTERNAL_H */

3
libavcodec/utils.c
View File

@@ -610,6 +610,9 @@ int attribute_align_arg avcodec_open2(AVCodecContext *avctx, AVCodec *codec, AVD
int ret = 0; int ret = 0;
AVDictionary *tmp = NULL; AVDictionary *tmp = NULL;
if (avctx->extradata_size < 0 || avctx->extradata_size >= FF_MAX_EXTRADATA_SIZE)
return AVERROR(EINVAL);
if (options) if (options)
av_dict_copy(&tmp, *options, 0); av_dict_copy(&tmp, *options, 0);

4
libavformat/utils.c
View File

@@ -2442,9 +2442,11 @@ int avformat_find_stream_info(AVFormatContext *ic, AVDictionary **options)
} }
if(st->parser && st->parser->parser->split && !st->codec->extradata){ if(st->parser && st->parser->parser->split && !st->codec->extradata){
int i= st->parser->parser->split(st->codec, pkt->data, pkt->size); int i= st->parser->parser->split(st->codec, pkt->data, pkt->size);
if(i){ if (i > 0 && i < FF_MAX_EXTRADATA_SIZE) {
st->codec->extradata_size= i; st->codec->extradata_size= i;
st->codec->extradata= av_malloc(st->codec->extradata_size + FF_INPUT_BUFFER_PADDING_SIZE); st->codec->extradata= av_malloc(st->codec->extradata_size + FF_INPUT_BUFFER_PADDING_SIZE);
if (!st->codec->extradata)
return AVERROR(ENOMEM);
memcpy(st->codec->extradata, pkt->data, st->codec->extradata_size); memcpy(st->codec->extradata, pkt->data, st->codec->extradata_size);
memset(st->codec->extradata + i, 0, FF_INPUT_BUFFER_PADDING_SIZE); memset(st->codec->extradata + i, 0, FF_INPUT_BUFFER_PADDING_SIZE);
} }