virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-01-13 21:28:01 +02:00
Code Issues Releases Activity

Merge commit '5d0450461ff729be5f531d333d29754155e406c5'

Browse Source 
* commit '5d0450461ff729be5f531d333d29754155e406c5':
  idcin: better error handling
  idcin: check for integer overflow when calling av_get_packet()

Conflicts:
	libavformat/idcin.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2013-01-10 12:52:02 +01:00
commit 56ca871fb3
1 changed files with 31 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

35
libavformat/idcin.c
View File

@ -147,6 +147,7 @@ static int idcin_read_header(AVFormatContext *s)
AVStream *st;
unsigned int width, height;
unsigned int sample_rate, bytes_per_sample, channels;
int ret;
/* get the 5 header parameters */
width = avio_rl32(pb);
@ -155,6 +156,11 @@ static int idcin_read_header(AVFormatContext *s)
bytes_per_sample = avio_rl32(pb);
channels = avio_rl32(pb);
if (s->pb->eof_reached) {
av_log(s, AV_LOG_ERROR, "incomplete header\n");
return s->pb->error ? s->pb->error : AVERROR_EOF;
}
if (av_image_check_size(width, height, 0, s) < 0)
return AVERROR_INVALIDDATA;
if (sample_rate > 0) {
@ -192,9 +198,13 @@ static int idcin_read_header(AVFormatContext *s)
/* load up the Huffman tables into extradata */
st->codec->extradata_size = HUFFMAN_TABLE_SIZE;
st->codec->extradata = av_malloc(HUFFMAN_TABLE_SIZE);
if (avio_read(pb, st->codec->extradata, HUFFMAN_TABLE_SIZE) !=
HUFFMAN_TABLE_SIZE)
ret = avio_read(pb, st->codec->extradata, HUFFMAN_TABLE_SIZE);
if (ret < 0) {
return ret;
} else if (ret != HUFFMAN_TABLE_SIZE) {
av_log(s, AV_LOG_ERROR, "incomplete header\n");
return AVERROR(EIO);
}
if (idcin->audio_present) {
idcin->audio_present = 1;
@ -251,7 +261,7 @@ static int idcin_read_packet(AVFormatContext *s,
uint32_t palette[256];
if (url_feof(s->pb))
return AVERROR(EIO);
return s->pb->error ? s->pb->error : AVERROR_EOF;
if (idcin->next_chunk_is_video) {
command = avio_rl32(pb);
@ -259,8 +269,13 @@ static int idcin_read_packet(AVFormatContext *s,
return AVERROR(EIO);
} else if (command == 1) {
/* trigger a palette change */
if (avio_read(pb, palette_buffer, 768) != 768)
ret = avio_read(pb, palette_buffer, 768);
if (ret < 0) {
return ret;
} else if (ret != 768) {
av_log(s, AV_LOG_ERROR, "incomplete packet\n");
return AVERROR(EIO);
}
/* scale the palette as necessary */
palette_scale = 2;
for (i = 0; i < 768; i++)
@ -279,7 +294,15 @@ static int idcin_read_packet(AVFormatContext *s,
}
}
if (s->pb->eof_reached) {
av_log(s, AV_LOG_ERROR, "incomplete packet\n");
return s->pb->error ? s->pb->error : AVERROR_EOF;
}
chunk_size = avio_rl32(pb);
if (chunk_size < 4 || chunk_size > INT_MAX - 4) {
av_log(s, AV_LOG_ERROR, "invalid chunk size: %u\n", chunk_size);
return AVERROR_INVALIDDATA;
}
/* skip the number of decoded bytes (always equal to width * height) */
avio_skip(pb, 4);
if (chunk_size < 4)
@ -288,6 +311,10 @@ static int idcin_read_packet(AVFormatContext *s,
ret= av_get_packet(pb, pkt, chunk_size);
if (ret < 0)
return ret;
else if (ret != chunk_size) {
av_log(s, AV_LOG_ERROR, "incomplete packet\n");
return AVERROR(EIO);
}
if (command == 1) {
uint8_t *pal;