diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-12-12 09:55:56 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-12-12 09:55:56 +0100 |
| commit | be5389d58521514ab3cd428977a00834f375b9ee (patch) | |
| tree | 59da1dd5b8a4b09a79bec16e089a687f62ef97cb /libavformat/swfdec.c | |
| parent | 9138f6da4a3ee0d11947b8593db6b6b05e53fbae (diff) | |
| parent | e70c5b034c4787377e82cab2d5565486baec0c2a (diff) | |
Merge commit 'e70c5b034c4787377e82cab2d5565486baec0c2a'
* commit 'e70c5b034c4787377e82cab2d5565486baec0c2a':
swfdec: do better validation of tag length
Make LOCAL_ALIGNED syntactically similar on all systems
Conflicts:
libavformat/swfdec.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavformat/swfdec.c')
| -rw-r--r-- | libavformat/swfdec.c | 20 |
1 files changed, 16 insertions, 4 deletions
diff --git a/libavformat/swfdec.c b/libavformat/swfdec.c index eb71208060..6ad92a0dbd 100644 --- a/libavformat/swfdec.c +++ b/libavformat/swfdec.c @@ -156,7 +156,7 @@ static int swf_read_packet(AVFormatContext *s, AVPacket *pkt) if (tag < 0) return tag; if (len < 0) { - av_log(s, AV_LOG_ERROR, "len %d is invalid\n", len); + av_log(s, AV_LOG_ERROR, "invalid tag length: %d\n", len); return AVERROR_INVALIDDATA; } if (tag == TAG_VIDEOSTREAM) { @@ -258,7 +258,10 @@ static int swf_read_packet(AVFormatContext *s, AVPacket *pkt) st = s->streams[i]; if (st->codec->codec_type == AVMEDIA_TYPE_VIDEO && st->id == ch_id) { frame = avio_rl16(pb); - if ((res = av_get_packet(pb, pkt, len-2)) < 0) + len -= 2; + if (len <= 0) + goto skip; + if ((res = av_get_packet(pb, pkt, len)) < 0) return res; pkt->pos = pos; pkt->pts = frame; @@ -398,9 +401,14 @@ bitmap_end_skip: if (st->codec->codec_type == AVMEDIA_TYPE_AUDIO && st->id == -1) { if (st->codec->codec_id == AV_CODEC_ID_MP3) { avio_skip(pb, 4); - if ((res = av_get_packet(pb, pkt, len-4)) < 0) + len -= 4; + if (len <= 0) + goto skip; + if ((res = av_get_packet(pb, pkt, len)) < 0) return res; } else { // ADPCM, PCM + if (len <= 0) + goto skip; if ((res = av_get_packet(pb, pkt, len)) < 0) return res; } @@ -426,7 +434,10 @@ bitmap_end_skip: st = vst; } avio_rl16(pb); /* BITMAP_ID */ - if ((res = av_new_packet(pkt, len-2)) < 0) + len -= 2; + if (len < 4) + goto skip; + if ((res = av_new_packet(pkt, len)) < 0) return res; avio_read(pb, pkt->data, 4); if (AV_RB32(pkt->data) == 0xffd8ffd9 || @@ -445,6 +456,7 @@ bitmap_end_skip: av_log(s, AV_LOG_DEBUG, "Unknown tag: %d\n", tag); } skip: + len = FFMAX(0, len); avio_skip(pb, len); } } |