virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2024-11-21 10:55:51 +02:00
Code Issues Releases Activity

Merge commit '0ef1660a6365ce60ead8858936b6f3f8ea862826'

Browse Source 
* commit '0ef1660a6365ce60ead8858936b6f3f8ea862826':
  sierravmd: Do sanity checking of frame sizes

Conflicts:
	libavformat/sierravmd.c

See: 47c4713a23
Merged-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2013-09-16 12:32:24 +02:00
commit cfa909ef5b
1 changed files with 16 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
libavformat/sierravmd.c
View File

@ -91,7 +91,8 @@ static int vmd_read_header(AVFormatContext *s)
unsigned char *raw_frame_table;
int raw_frame_table_size;
int64_t current_offset;
int i, j, width, height;
int i, j, ret;
int width, height;
unsigned int total_frames;
int64_t current_audio_pts = 0;
unsigned char chunk[BYTES_PER_FRAME_RECORD];
@ -186,15 +187,13 @@ static int vmd_read_header(AVFormatContext *s)
raw_frame_table = av_malloc(raw_frame_table_size);
vmd->frame_table = av_malloc((vmd->frame_count * vmd->frames_per_block + sound_buffers) * sizeof(vmd_frame));
if (!raw_frame_table || !vmd->frame_table) {
av_free(raw_frame_table);
av_free(vmd->frame_table);
return AVERROR(ENOMEM);
ret = AVERROR(ENOMEM);
goto error;
}
if (avio_read(pb, raw_frame_table, raw_frame_table_size) !=
raw_frame_table_size) {
av_free(raw_frame_table);
av_free(vmd->frame_table);
return AVERROR(EIO);
ret = AVERROR(EIO);
goto error;
}
total_frames = 0;
@ -210,6 +209,11 @@ static int vmd_read_header(AVFormatContext *s)
avio_read(pb, chunk, BYTES_PER_FRAME_RECORD);
type = chunk[0];
size = AV_RL32(&chunk[2]);
if (size > INT_MAX / 2) {
av_log(s, AV_LOG_ERROR, "Invalid frame size\n");
ret = AVERROR_INVALIDDATA;
goto error;
}
if(!size && type != 1)
continue;
switch(type) {
@ -246,6 +250,11 @@ static int vmd_read_header(AVFormatContext *s)
vmd->frame_count = total_frames;
return 0;
error:
av_free(raw_frame_table);
av_free(vmd->frame_table);
return ret;
}
static int vmd_read_packet(AVFormatContext *s,