diff options
| -rw-r--r-- | libavcodec/bmv.c | 2 | ||||
| -rw-r--r-- | libavformat/xmv.c | 35 |
2 files changed, 22 insertions, 15 deletions
diff --git a/libavcodec/bmv.c b/libavcodec/bmv.c index 2628e4a2c0..0f3f9f32c0 100644 --- a/libavcodec/bmv.c +++ b/libavcodec/bmv.c @@ -139,7 +139,7 @@ static int decode_bmv_frame(const uint8_t *source, int src_len, uint8_t *frame, mode += 1 + advance_mode; if (mode >= 4) mode -= 3; - if (FFABS(dst_end - dst) < len) + if (len <= 0 || FFABS(dst_end - dst) < len) return AVERROR_INVALIDDATA; switch (mode) { case 1: diff --git a/libavformat/xmv.c b/libavformat/xmv.c index e970477339..df950e5262 100644 --- a/libavformat/xmv.c +++ b/libavformat/xmv.c @@ -124,6 +124,15 @@ static int xmv_probe(AVProbeData *p) return 0; } +static int xmv_read_close(AVFormatContext *s) +{ + XMVDemuxContext *xmv = s->priv_data; + + av_freep(&xmv->audio); + + return 0; +} + static int xmv_read_header(AVFormatContext *s) { XMVDemuxContext *xmv = s->priv_data; @@ -133,6 +142,7 @@ static int xmv_read_header(AVFormatContext *s) uint32_t file_version; uint32_t this_packet_size; uint16_t audio_track; + int ret; avio_skip(pb, 4); /* Next packet size */ @@ -184,11 +194,6 @@ static int xmv_read_header(AVFormatContext *s) packet->bits_per_sample = avio_rl16(pb); packet->flags = avio_rl16(pb); - if (!packet->channels) { - av_log(s, AV_LOG_ERROR, "0 channels\n"); - return AVERROR(EINVAL); - } - packet->bit_rate = packet->bits_per_sample * packet->sample_rate * packet->channels; @@ -208,6 +213,13 @@ static int xmv_read_header(AVFormatContext *s) av_log(s, AV_LOG_WARNING, "Unsupported 5.1 ADPCM audio stream " "(0x%04X)\n", packet->flags); + if (!packet->channels || !packet->sample_rate) { + av_log(s, AV_LOG_ERROR, "Invalid parameters for audio track %d.\n", + audio_track); + ret = AVERROR_INVALIDDATA; + goto fail; + } + ast = avformat_new_stream(s, NULL); if (!ast) return AVERROR(ENOMEM); @@ -236,6 +248,10 @@ static int xmv_read_header(AVFormatContext *s) xmv->stream_count = xmv->audio_track_count + 1; return 0; + +fail: + xmv_read_close(s); + return ret; } static void xmv_read_extradata(uint8_t *extradata, AVIOContext *pb) @@ -546,15 +562,6 @@ static int xmv_read_packet(AVFormatContext *s, return 0; } -static int xmv_read_close(AVFormatContext *s) -{ - XMVDemuxContext *xmv = s->priv_data; - - av_freep(&xmv->audio); - - return 0; -} - AVInputFormat ff_xmv_demuxer = { .name = "xmv", .long_name = NULL_IF_CONFIG_SMALL("Microsoft XMV"), |