From e471faf96230076f67e393df9d1a90a08c22a055 Mon Sep 17 00:00:00 2001 From: Andreas Rheinhardt Date: Wed, 25 Mar 2020 06:00:53 +0100 Subject: avformat/matroskadec: Don't discard valid packets A Block (meaning both a Block in a BlockGroup as well as a SimpleBlock) must have at least three bytes after the field containing the encoded TrackNumber. So if there are <= 3 bytes, the Matroska demuxer would skip this block, believing it to be an empty, but valid Block. This might discard valid nonempty Blocks, namely if the track uses header stripping. And certain definitely spec-incompliant Blocks don't raise errors: Those with two or less bytes left after the encoded TrackNumber and those with three bytes left, but with flags indicating that the Block uses lacing as then there has to be further data describing the lacing. Furthermore, zero-sized packets were still possible because only the size of the last entry of a lace was checked. This commit fixes this. All spec-compliant Blocks that contain data (even if side data only) are now returned to the caller; spec-compliant Blocks that don't contain anything are not returned. Signed-off-by: Andreas Rheinhardt --- libavformat/matroskadec.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) (limited to 'libavformat/matroskadec.c') diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c index 5643e15a20..3b1b447d8a 100644 --- a/libavformat/matroskadec.c +++ b/libavformat/matroskadec.c @@ -3020,7 +3020,9 @@ static int matroska_parse_laces(MatroskaDemuxContext *matroska, uint8_t **buf, return 0; } - av_assert0(size > 0); + if (size <= 0) + return AVERROR_INVALIDDATA; + *laces = *data + 1; data += 1; size -= 1; @@ -3046,7 +3048,7 @@ static int matroska_parse_laces(MatroskaDemuxContext *matroska, uint8_t **buf, break; } } - if (size <= total) { + if (size < total) { return AVERROR_INVALIDDATA; } @@ -3093,7 +3095,7 @@ static int matroska_parse_laces(MatroskaDemuxContext *matroska, uint8_t **buf, } data += offset; size -= offset; - if (size <= total) { + if (size < total) { return AVERROR_INVALIDDATA; } lace_size[*laces - 1] = size - total; @@ -3413,7 +3415,7 @@ static int matroska_parse_frame(MatroskaDemuxContext *matroska, { MatroskaTrackEncoding *encodings = track->encodings.elem; uint8_t *pkt_data = data; - int res; + int res = 0; AVPacket pktl, *pkt = &pktl; if (encodings && !encodings->type && encodings->scope & 1) { @@ -3449,6 +3451,9 @@ static int matroska_parse_frame(MatroskaDemuxContext *matroska, pkt_data = pr_data; } + if (!pkt_size && !additional_size) + goto no_output; + av_init_packet(pkt); if (pkt_data != data) pkt->buf = av_buffer_create(pkt_data, pkt_size + AV_INPUT_BUFFER_PADDING_SIZE, @@ -3519,6 +3524,7 @@ FF_ENABLE_DEPRECATION_WARNINGS return 0; +no_output: fail: if (pkt_data != data) av_freep(&pkt_data); @@ -3554,8 +3560,8 @@ static int matroska_parse_block(MatroskaDemuxContext *matroska, AVBufferRef *buf av_log(matroska->ctx, AV_LOG_INFO, "Invalid stream %"PRIu64"\n", num); return AVERROR_INVALIDDATA; - } else if (size <= 3) - return 0; + } else if (size < 3) + return AVERROR_INVALIDDATA; st = track->stream; if (st->discard >= AVDISCARD_ALL) return res; -- cgit v1.2.3