Mercurial > libavcodec.hg
comparison mlpdec.c @ 9348:586dca8c04e7 libavcodec
mlpdec: Validate non-restart bit from the substream header.
author | ramiro |
---|---|
date | Sun, 05 Apr 2009 20:46:53 +0000 |
parents | b799c2a83624 |
children | 1a3bb292b65d |
comparison
equal
deleted
inserted
replaced
9347:b799c2a83624 | 9348:586dca8c04e7 |
---|---|
115 } SubStream; | 115 } SubStream; |
116 | 116 |
117 typedef struct MLPDecodeContext { | 117 typedef struct MLPDecodeContext { |
118 AVCodecContext *avctx; | 118 AVCodecContext *avctx; |
119 | 119 |
120 //! Current access unit being read has a major sync. | |
121 int is_major_sync_unit; | |
122 | |
120 //! Set if a valid major sync block has been read. Otherwise no decoding is possible. | 123 //! Set if a valid major sync block has been read. Otherwise no decoding is possible. |
121 uint8_t params_valid; | 124 uint8_t params_valid; |
122 | 125 |
123 //! Number of substreams contained within this stream. | 126 //! Number of substreams contained within this stream. |
124 uint8_t num_substreams; | 127 uint8_t num_substreams; |
915 if (length > buf_size) | 918 if (length > buf_size) |
916 return -1; | 919 return -1; |
917 | 920 |
918 init_get_bits(&gb, (buf + 4), (length - 4) * 8); | 921 init_get_bits(&gb, (buf + 4), (length - 4) * 8); |
919 | 922 |
923 m->is_major_sync_unit = 0; | |
920 if (show_bits_long(&gb, 31) == (0xf8726fba >> 1)) { | 924 if (show_bits_long(&gb, 31) == (0xf8726fba >> 1)) { |
921 if (read_major_sync(m, &gb) < 0) | 925 if (read_major_sync(m, &gb) < 0) |
922 goto error; | 926 goto error; |
927 m->is_major_sync_unit = 1; | |
923 header_size += 28; | 928 header_size += 28; |
924 } | 929 } |
925 | 930 |
926 if (!m->params_valid) { | 931 if (!m->params_valid) { |
927 av_log(m->avctx, AV_LOG_WARNING, | 932 av_log(m->avctx, AV_LOG_WARNING, |
931 } | 936 } |
932 | 937 |
933 substream_start = 0; | 938 substream_start = 0; |
934 | 939 |
935 for (substr = 0; substr < m->num_substreams; substr++) { | 940 for (substr = 0; substr < m->num_substreams; substr++) { |
936 int extraword_present, checkdata_present, end; | 941 int extraword_present, checkdata_present, end, nonrestart_substr; |
937 | 942 |
938 extraword_present = get_bits1(&gb); | 943 extraword_present = get_bits1(&gb); |
939 skip_bits1(&gb); | 944 nonrestart_substr = get_bits1(&gb); |
940 checkdata_present = get_bits1(&gb); | 945 checkdata_present = get_bits1(&gb); |
941 skip_bits1(&gb); | 946 skip_bits1(&gb); |
942 | 947 |
943 end = get_bits(&gb, 12) * 2; | 948 end = get_bits(&gb, 12) * 2; |
944 | 949 |
945 substr_header_size += 2; | 950 substr_header_size += 2; |
946 | 951 |
947 if (extraword_present) { | 952 if (extraword_present) { |
948 skip_bits(&gb, 16); | 953 skip_bits(&gb, 16); |
949 substr_header_size += 2; | 954 substr_header_size += 2; |
955 } | |
956 | |
957 if (!(nonrestart_substr ^ m->is_major_sync_unit)) { | |
958 av_log(m->avctx, AV_LOG_ERROR, "Invalid nonrestart_substr.\n"); | |
959 goto error; | |
950 } | 960 } |
951 | 961 |
952 if (end + header_size + substr_header_size > length) { | 962 if (end + header_size + substr_header_size > length) { |
953 av_log(m->avctx, AV_LOG_ERROR, | 963 av_log(m->avctx, AV_LOG_ERROR, |
954 "Indicated length of substream %d data goes off end of " | 964 "Indicated length of substream %d data goes off end of " |