virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2024-12-23 12:43:46 +02:00
Code Issues Releases Activity

eamad: use the bytestream2 API instead of AV_RL

Browse Source 
This is safer and possibly fixes invalid reads on truncated data.

CC:libav-stable@libav.org
This commit is contained in:
Anton Khirnov 2014-07-20 12:06:47 +00:00
parent 7215fcf840
commit 541427ab4d
1 changed files with 20 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

37
libavcodec/eamad.c
View File

@ -29,6 +29,7 @@
*/ */
#include "avcodec.h" #include "avcodec.h"
#include "bytestream.h"
#include "bswapdsp.h" #include "bswapdsp.h"
#include "get_bits.h" #include "get_bits.h"
#include "aandcttab.h" #include "aandcttab.h"
@ -235,30 +236,32 @@ static int decode_frame(AVCodecContext *avctx,
{ {
const uint8_t *buf = avpkt->data; const uint8_t *buf = avpkt->data;
int buf_size = avpkt->size; int buf_size = avpkt->size;
const uint8_t *buf_end = buf+buf_size;
MadContext *s = avctx->priv_data; MadContext *s = avctx->priv_data;
AVFrame *frame = data; AVFrame *frame = data;
GetByteContext gb;
int width, height; int width, height;
int chunk_type; int chunk_type;
int inter, ret; int inter, ret;
if (buf_size < 17) { bytestream2_init(&gb, buf, buf_size);
av_log(avctx, AV_LOG_ERROR, "Input buffer too small\n");
*got_frame = 0;
return -1;
}
chunk_type = AV_RL32(&buf[0]); chunk_type = bytestream2_get_le32(&gb);
inter = (chunk_type == MADm_TAG || chunk_type == MADe_TAG); inter = (chunk_type == MADm_TAG || chunk_type == MADe_TAG);
buf += 8; bytestream2_skip(&gb, 10);
av_reduce(&avctx->time_base.num, &avctx->time_base.den, av_reduce(&avctx->time_base.num, &avctx->time_base.den,
AV_RL16(&buf[6]), 1000, 1<<30); bytestream2_get_le16(&gb), 1000, 1<<30);
width = AV_RL16(&buf[8]); width = bytestream2_get_le16(&gb);
height = AV_RL16(&buf[10]); height = bytestream2_get_le16(&gb);
calc_quant_matrix(s, buf[13]); bytestream2_skip(&gb, 1);
buf += 16; calc_quant_matrix(s, bytestream2_get_byte(&gb));
bytestream2_skip(&gb, 2);
if (bytestream2_get_bytes_left(&gb) < 2) {
av_log(avctx, AV_LOG_ERROR, "Input data too small\n");
return AVERROR_INVALIDDATA;
}
if (avctx->width != width || avctx->height != height) { if (avctx->width != width || avctx->height != height) {
av_frame_unref(s->last_frame); av_frame_unref(s->last_frame);
@ -285,12 +288,12 @@ static int decode_frame(AVCodecContext *avctx,
} }
av_fast_padded_malloc(&s->bitstream_buf, &s->bitstream_buf_size, av_fast_padded_malloc(&s->bitstream_buf, &s->bitstream_buf_size,
buf_end - buf); bytestream2_get_bytes_left(&gb));
if (!s->bitstream_buf) if (!s->bitstream_buf)
return AVERROR(ENOMEM); return AVERROR(ENOMEM);
s->bbdsp.bswap16_buf(s->bitstream_buf, (const uint16_t *) buf, s->bbdsp.bswap16_buf(s->bitstream_buf, (const uint16_t *)(buf + bytestream2_tell(&gb)),
(buf_end - buf) / 2); bytestream2_get_bytes_left(&gb) / 2);
init_get_bits(&s->gb, s->bitstream_buf, 8*(buf_end-buf)); init_get_bits(&s->gb, s->bitstream_buf, 8*(bytestream2_get_bytes_left(&gb)));
for (s->mb_y=0; s->mb_y < (avctx->height+15)/16; s->mb_y++) for (s->mb_y=0; s->mb_y < (avctx->height+15)/16; s->mb_y++)
for (s->mb_x=0; s->mb_x < (avctx->width +15)/16; s->mb_x++) for (s->mb_x=0; s->mb_x < (avctx->width +15)/16; s->mb_x++)