From 3068f1c81342a47b66cc7d2f54f340de3ec3dcbf Mon Sep 17 00:00:00 2001 From: Baptiste Coudurier Date: Tue, 1 Aug 2006 09:56:27 +0000 Subject: avoid reading beyond packet size Originally committed as revision 5878 to svn://svn.ffmpeg.org/ffmpeg/trunk --- libavformat/gxfenc.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) (limited to 'libavformat') diff --git a/libavformat/gxfenc.c b/libavformat/gxfenc.c index 480821b3ef..7c784fbb81 100644 --- a/libavformat/gxfenc.c +++ b/libavformat/gxfenc.c @@ -724,14 +724,13 @@ static int gxf_write_media_packet(ByteIOContext *pb, GXFContext *ctx, AVPacket * gxf_write_packet_header(pb, PKT_MEDIA); if (sc->codec->codec_id == CODEC_ID_MPEG2VIDEO && pkt->size % 4) /* MPEG-2 frames must be padded */ padding = 4 - pkt->size % 4; + else if (sc->codec->codec_type == CODEC_TYPE_AUDIO) + padding = GXF_AUDIO_PACKET_SIZE - pkt->size; gxf_write_media_preamble(pb, ctx, pkt, pkt->size + padding); - if (sc->codec->codec_type == CODEC_TYPE_AUDIO) - put_buffer(pb, pkt->data, GXF_AUDIO_PACKET_SIZE); - else { - ctx->field_number += 2; - put_buffer(pb, pkt->data, pkt->size); - } + put_buffer(pb, pkt->data, pkt->size); gxf_write_padding(pb, padding); + if (sc->codec->codec_type == CODEC_TYPE_VIDEO) + ctx->field_number += 2; return updatePacketSize(pb, pos); } @@ -793,11 +792,10 @@ static int gxf_interleave_packet(AVFormatContext *s, AVPacket *out, AVPacket *pk if (sc->codec->codec_type == CODEC_TYPE_AUDIO && (flush || fifo_size(&sc->audio_buffer, NULL) >= GXF_AUDIO_PACKET_SIZE)) { int size = flush ? fifo_size(&sc->audio_buffer, NULL) : GXF_AUDIO_PACKET_SIZE; - av_new_packet(out, GXF_AUDIO_PACKET_SIZE); + av_new_packet(out, size); fifo_read(&sc->audio_buffer, out->data, size, NULL); gxf->audio_written++; out->stream_index = i; - out->size = size; return 1; } } -- cgit v1.2.3