Mercurial > libavformat.hg
comparison rm.c @ 1079:40e81416015d libavformat
sanity checks some might have been exploitable
| author | michael |
|---|---|
| date | Sat, 13 May 2006 11:37:56 +0000 |
| parents | d2e5dfdf4def |
| children | d187ac890c0e |
comparison
equal
deleted
inserted
replaced
| 1078:0bc9422cc0ad | 1079:40e81416015d |
|---|---|
| 553 } else if (!strcmp(buf, "28_8")) { | 553 } else if (!strcmp(buf, "28_8")) { |
| 554 st->codec->codec_id = CODEC_ID_RA_288; | 554 st->codec->codec_id = CODEC_ID_RA_288; |
| 555 st->codec->extradata_size= 0; | 555 st->codec->extradata_size= 0; |
| 556 rm->audio_framesize = st->codec->block_align; | 556 rm->audio_framesize = st->codec->block_align; |
| 557 st->codec->block_align = coded_framesize; | 557 st->codec->block_align = coded_framesize; |
| 558 | |
| 559 if(rm->audio_framesize >= UINT_MAX / sub_packet_h){ | |
| 560 av_log(s, AV_LOG_ERROR, "rm->audio_framesize * sub_packet_h too large\n"); | |
| 561 return -1; | |
| 562 } | |
| 563 | |
| 558 rm->audiobuf = av_malloc(rm->audio_framesize * sub_packet_h); | 564 rm->audiobuf = av_malloc(rm->audio_framesize * sub_packet_h); |
| 559 } else if (!strcmp(buf, "cook")) { | 565 } else if (!strcmp(buf, "cook")) { |
| 560 int codecdata_length, i; | 566 int codecdata_length, i; |
| 561 get_be16(pb); get_byte(pb); | 567 get_be16(pb); get_byte(pb); |
| 562 if (((version >> 16) & 0xff) == 5) | 568 if (((version >> 16) & 0xff) == 5) |
| 563 get_byte(pb); | 569 get_byte(pb); |
| 564 codecdata_length = get_be32(pb); | 570 codecdata_length = get_be32(pb); |
| 571 if(codecdata_length + FF_INPUT_BUFFER_PADDING_SIZE <= (unsigned)codecdata_length){ | |
| 572 av_log(s, AV_LOG_ERROR, "codecdata_length too large\n"); | |
| 573 return -1; | |
| 574 } | |
| 575 | |
| 565 st->codec->codec_id = CODEC_ID_COOK; | 576 st->codec->codec_id = CODEC_ID_COOK; |
| 566 st->codec->extradata_size= codecdata_length; | 577 st->codec->extradata_size= codecdata_length; |
| 567 st->codec->extradata= av_mallocz(st->codec->extradata_size + FF_INPUT_BUFFER_PADDING_SIZE); | 578 st->codec->extradata= av_mallocz(st->codec->extradata_size + FF_INPUT_BUFFER_PADDING_SIZE); |
| 568 for(i = 0; i < codecdata_length; i++) | 579 for(i = 0; i < codecdata_length; i++) |
| 569 ((uint8_t*)st->codec->extradata)[i] = get_byte(pb); | 580 ((uint8_t*)st->codec->extradata)[i] = get_byte(pb); |
| 570 rm->audio_framesize = st->codec->block_align; | 581 rm->audio_framesize = st->codec->block_align; |
| 571 st->codec->block_align = rm->sub_packet_size; | 582 st->codec->block_align = rm->sub_packet_size; |
| 583 | |
| 584 if(rm->audio_framesize >= UINT_MAX / sub_packet_h){ | |
| 585 av_log(s, AV_LOG_ERROR, "rm->audio_framesize * sub_packet_h too large\n"); | |
| 586 return -1; | |
| 587 } | |
| 588 | |
| 572 rm->audiobuf = av_malloc(rm->audio_framesize * sub_packet_h); | 589 rm->audiobuf = av_malloc(rm->audio_framesize * sub_packet_h); |
| 573 } else { | 590 } else { |
| 574 st->codec->codec_id = CODEC_ID_NONE; | 591 st->codec->codec_id = CODEC_ID_NONE; |
| 575 pstrcpy(st->codec->codec_name, sizeof(st->codec->codec_name), | 592 pstrcpy(st->codec->codec_name, sizeof(st->codec->codec_name), |
| 576 buf); | 593 buf); |
| 713 get_be32(pb); | 730 get_be32(pb); |
| 714 fps2= get_be16(pb); | 731 fps2= get_be16(pb); |
| 715 get_be16(pb); | 732 get_be16(pb); |
| 716 | 733 |
| 717 st->codec->extradata_size= codec_data_size - (url_ftell(pb) - codec_pos); | 734 st->codec->extradata_size= codec_data_size - (url_ftell(pb) - codec_pos); |
| 735 | |
| 736 if(st->codec->extradata_size + FF_INPUT_BUFFER_PADDING_SIZE <= (unsigned)st->codec->extradata_size){ | |
| 737 //check is redundant as get_buffer() will catch this | |
| 738 av_log(s, AV_LOG_ERROR, "st->codec->extradata_size too large\n"); | |
| 739 return -1; | |
| 740 } | |
| 718 st->codec->extradata= av_mallocz(st->codec->extradata_size + FF_INPUT_BUFFER_PADDING_SIZE); | 741 st->codec->extradata= av_mallocz(st->codec->extradata_size + FF_INPUT_BUFFER_PADDING_SIZE); |
| 719 get_buffer(pb, st->codec->extradata, st->codec->extradata_size); | 742 get_buffer(pb, st->codec->extradata, st->codec->extradata_size); |
| 720 | 743 |
| 721 // av_log(NULL, AV_LOG_DEBUG, "fps= %d fps2= %d\n", fps, fps2); | 744 // av_log(NULL, AV_LOG_DEBUG, "fps= %d fps2= %d\n", fps, fps2); |
| 722 st->codec->time_base.den = fps * st->codec->time_base.num; | 745 st->codec->time_base.den = fps * st->codec->time_base.num; |