From 7b03b65bf0d02519c86750d2da33f413e11cf0c6 Mon Sep 17 00:00:00 2001
From: Anton Khirnov <anton@khirnov.net>
Date: Mon, 20 Jan 2014 14:10:01 +0100
Subject: lavf: do basic sanity checking on muxed packets

Reject packets for non-existing or attachment streams.
---
 libavformat/mux.c | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

(limited to 'libavformat/mux.c')

diff --git a/libavformat/mux.c b/libavformat/mux.c
index 505ed2e6f8..24c4932ed7 100644
--- a/libavformat/mux.c
+++ b/libavformat/mux.c
@@ -429,10 +429,33 @@ static int write_packet(AVFormatContext *s, AVPacket *pkt)
     return ret;
 }
 
+static int check_packet(AVFormatContext *s, AVPacket *pkt)
+{
+    if (!pkt)
+        return 0;
+
+    if (pkt->stream_index < 0 || pkt->stream_index >= s->nb_streams) {
+        av_log(s, AV_LOG_ERROR, "Invalid packet stream index: %d\n",
+               pkt->stream_index);
+        return AVERROR(EINVAL);
+    }
+
+    if (s->streams[pkt->stream_index]->codec->codec_type == AVMEDIA_TYPE_ATTACHMENT) {
+        av_log(s, AV_LOG_ERROR, "Received a packet for an attachment stream.\n");
+        return AVERROR(EINVAL);
+    }
+
+    return 0;
+}
+
 int av_write_frame(AVFormatContext *s, AVPacket *pkt)
 {
     int ret;
 
+    ret = check_packet(s, pkt);
+    if (ret < 0)
+        return ret;
+
     if (!pkt) {
         if (s->oformat->flags & AVFMT_ALLOW_FLUSH)
             return s->oformat->write_packet(s, pkt);
@@ -560,6 +583,10 @@ int av_interleaved_write_frame(AVFormatContext *s, AVPacket *pkt)
 {
     int ret, flush = 0;
 
+    ret = check_packet(s, pkt);
+    if (ret < 0)
+        return ret;
+
     if (pkt) {
         AVStream *st = s->streams[pkt->stream_index];
 
-- 
cgit v1.2.3