virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-04-02 20:35:37 +02:00
Code Issues Releases Activity

avformat/aiffdec: cleanup size handling for extreem cases

Browse Source 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2022-03-23 14:30:42 +01:00
parent 55c605f72c
commit c6f1e48b86
1 changed files with 12 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
libavformat/aiffdec.c
View File

@ -54,9 +54,9 @@ static enum AVCodecID aiff_codec_get_id(int bps)
} }
/* returns the size of the found tag */ /* returns the size of the found tag */
static int get_tag(AVIOContext *pb, uint32_t * tag) static int64_t get_tag(AVIOContext *pb, uint32_t * tag)
{ {
int size; int64_t size;
if (avio_feof(pb)) if (avio_feof(pb))
return AVERROR(EIO); return AVERROR(EIO);
@ -64,16 +64,16 @@ static int get_tag(AVIOContext *pb, uint32_t * tag)
*tag = avio_rl32(pb); *tag = avio_rl32(pb);
size = avio_rb32(pb); size = avio_rb32(pb);
if (size < 0)
size = 0x7fffffff;
return size; return size;
} }
/* Metadata string read */ /* Metadata string read */
static void get_meta(AVFormatContext *s, const char *key, int size) static void get_meta(AVFormatContext *s, const char *key, int64_t size)
{ {
uint8_t *str = av_malloc(size+1U); uint8_t *str = NULL;
if (size < SIZE_MAX)
str = av_malloc(size+1);
if (str) { if (str) {
int res = avio_read(s->pb, str, size); int res = avio_read(s->pb, str, size);
@ -90,7 +90,7 @@ static void get_meta(AVFormatContext *s, const char *key, int size)
} }
/* Returns the number of sound data frames or negative on error */ /* Returns the number of sound data frames or negative on error */
static int get_aiff_header(AVFormatContext *s, int size, static int get_aiff_header(AVFormatContext *s, int64_t size,
unsigned version) unsigned version)
{ {
AVIOContext *pb = s->pb; AVIOContext *pb = s->pb;
@ -102,9 +102,6 @@ static int get_aiff_header(AVFormatContext *s, int size,
unsigned int num_frames; unsigned int num_frames;
int channels; int channels;
if (size == INT_MAX)
return AVERROR_INVALIDDATA;
if (size & 1) if (size & 1)
size++; size++;
par->codec_type = AVMEDIA_TYPE_AUDIO; par->codec_type = AVMEDIA_TYPE_AUDIO;
@ -216,7 +213,8 @@ static int aiff_probe(const AVProbeData *p)
/* aiff input */ /* aiff input */
static int aiff_read_header(AVFormatContext *s) static int aiff_read_header(AVFormatContext *s)
{ {
int ret, size, filesize; int ret;
int64_t filesize, size;
int64_t offset = 0, position; int64_t offset = 0, position;
uint32_t tag; uint32_t tag;
unsigned version = AIFF_C_VERSION1; unsigned version = AIFF_C_VERSION1;
@ -227,7 +225,7 @@ static int aiff_read_header(AVFormatContext *s)
/* check FORM header */ /* check FORM header */
filesize = get_tag(pb, &tag); filesize = get_tag(pb, &tag);
if (filesize < 0 || tag != MKTAG('F', 'O', 'R', 'M')) if (filesize < 4 || tag != MKTAG('F', 'O', 'R', 'M'))
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
/* AIFF data type */ /* AIFF data type */
@ -254,10 +252,7 @@ static int aiff_read_header(AVFormatContext *s)
if (size < 0) if (size < 0)
return size; return size;
if (size >= 0x7fffffff - 8) filesize -= size + 8;
filesize = 0;
else
filesize -= size + 8;
switch (tag) { switch (tag) {
case MKTAG('C', 'O', 'M', 'M'): /* Common chunk */ case MKTAG('C', 'O', 'M', 'M'): /* Common chunk */