generic-library/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

avformat/wtvdec: ignore MPEG2VIDEO extradata when count is invalid

Browse Source 
Fixes ticket #3522.

Signed-off-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Peter Ross 2014-04-04 22:07:36 +11:00 committed by Michael Niedermayer
parent 0f62982335
commit 8348bd198f
1 changed files with 14 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
libavformat/wtvdec.c
View File

@ -635,7 +635,7 @@ static AVStream * new_stream(AVFormatContext *s, AVStream *st, int sid, int code
*/ */
static AVStream * parse_media_type(AVFormatContext *s, AVStream *st, int sid, static AVStream * parse_media_type(AVFormatContext *s, AVStream *st, int sid,
ff_asf_guid mediatype, ff_asf_guid subtype, ff_asf_guid mediatype, ff_asf_guid subtype,
ff_asf_guid formattype, int size) ff_asf_guid formattype, uint64_t size)
{ {
WtvContext *wtv = s->priv_data; WtvContext *wtv = s->priv_data;
AVIOContext *pb = wtv->pb; AVIOContext *pb = wtv->pb;
@ -693,16 +693,20 @@ static AVStream * parse_media_type(AVFormatContext *s, AVStream *st, int sid,
int consumed = parse_videoinfoheader2(s, st); int consumed = parse_videoinfoheader2(s, st);
avio_skip(pb, FFMAX(size - consumed, 0)); avio_skip(pb, FFMAX(size - consumed, 0));
} else if (!ff_guidcmp(formattype, ff_format_mpeg2_video)) { } else if (!ff_guidcmp(formattype, ff_format_mpeg2_video)) {
int consumed = parse_videoinfoheader2(s, st); uint64_t consumed = parse_videoinfoheader2(s, st);
int count; if (size - consumed >= 20) {
avio_skip(pb, 4); uint32_t count;
count = avio_rl32(pb); consumed += 20;
avio_skip(pb, 12); avio_skip(pb, 4);
if (count && ff_get_extradata(st->codec, pb, count) < 0) { count = avio_rl32(pb);
ff_free_stream(s, st); count = FFMIN(count, size - consumed);
return NULL; avio_skip(pb, 12);
if (count && ff_get_extradata(st->codec, pb, count) < 0) {
ff_free_stream(s, st);
return NULL;
}
consumed += count;
} }
consumed += 20 + count;
avio_skip(pb, FFMAX(size - consumed, 0)); avio_skip(pb, FFMAX(size - consumed, 0));
} else { } else {
if (ff_guidcmp(formattype, ff_format_none)) if (ff_guidcmp(formattype, ff_format_none))