har0ke/FFmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge commit 'd1016dccdcb10486245e5d7c186cc31af54b2a9c'

Browse Source 
* commit 'd1016dccdcb10486245e5d7c186cc31af54b2a9c':
  xmv: check audio track parameters validity.
  bmv: check for len being valid in bmv_decode_frame().

Conflicts:
	libavformat/xmv.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2013-04-04 14:20:51 +02:00
commit 208be6b54a
2 changed files with 22 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
libavcodec/bmv.c
View File

@ -139,7 +139,7 @@ static int decode_bmv_frame(const uint8_t *source, int src_len, uint8_t *frame,
mode += 1 + advance_mode;
if (mode >= 4)
mode -= 3;
if (FFABS(dst_end - dst) < len)
if (len <= 0 || FFABS(dst_end - dst) < len)
return AVERROR_INVALIDDATA;
switch (mode) {
case 1:

35
libavformat/xmv.c
View File

@ -124,6 +124,15 @@ static int xmv_probe(AVProbeData *p)
return 0;
}
static int xmv_read_close(AVFormatContext *s)
{
XMVDemuxContext *xmv = s->priv_data;
av_freep(&xmv->audio);
return 0;
}
static int xmv_read_header(AVFormatContext *s)
{
XMVDemuxContext *xmv = s->priv_data;
@ -133,6 +142,7 @@ static int xmv_read_header(AVFormatContext *s)
uint32_t file_version;
uint32_t this_packet_size;
uint16_t audio_track;
int ret;
avio_skip(pb, 4); /* Next packet size */
@ -184,11 +194,6 @@ static int xmv_read_header(AVFormatContext *s)
packet->bits_per_sample = avio_rl16(pb);
packet->flags = avio_rl16(pb);
if (!packet->channels) {
av_log(s, AV_LOG_ERROR, "0 channels\n");
return AVERROR(EINVAL);
}
packet->bit_rate = packet->bits_per_sample *
packet->sample_rate *
packet->channels;
@ -208,6 +213,13 @@ static int xmv_read_header(AVFormatContext *s)
av_log(s, AV_LOG_WARNING, "Unsupported 5.1 ADPCM audio stream "
"(0x%04X)\n", packet->flags);
if (!packet->channels || !packet->sample_rate) {
av_log(s, AV_LOG_ERROR, "Invalid parameters for audio track %d.\n",
audio_track);
ret = AVERROR_INVALIDDATA;
goto fail;
}
ast = avformat_new_stream(s, NULL);
if (!ast)
return AVERROR(ENOMEM);
@ -236,6 +248,10 @@ static int xmv_read_header(AVFormatContext *s)
xmv->stream_count = xmv->audio_track_count + 1;
return 0;
fail:
xmv_read_close(s);
return ret;
}
static void xmv_read_extradata(uint8_t *extradata, AVIOContext *pb)
@ -546,15 +562,6 @@ static int xmv_read_packet(AVFormatContext *s,
return 0;
}
static int xmv_read_close(AVFormatContext *s)
{
XMVDemuxContext *xmv = s->priv_data;
av_freep(&xmv->audio);
return 0;
}
AVInputFormat ff_xmv_demuxer = {
.name = "xmv",
.long_name = NULL_IF_CONFIG_SMALL("Microsoft XMV"),