changeset 1212:b4f48eb1f411 libavformat

avoid reading beyond packet size
author bcoudurier
date Tue, 01 Aug 2006 09:56:27 +0000
parents 2a06812eeca7
children fe9ebf4ce09e
files gxfenc.c
diffstat 1 files changed, 6 insertions(+), 8 deletions(-) [+]
line wrap: on
line diff
--- a/gxfenc.c	Tue Aug 01 00:32:47 2006 +0000
+++ b/gxfenc.c	Tue Aug 01 09:56:27 2006 +0000
@@ -724,14 +724,13 @@
     gxf_write_packet_header(pb, PKT_MEDIA);
     if (sc->codec->codec_id == CODEC_ID_MPEG2VIDEO && pkt->size % 4) /* MPEG-2 frames must be padded */
         padding = 4 - pkt->size % 4;
+    else if (sc->codec->codec_type == CODEC_TYPE_AUDIO)
+        padding = GXF_AUDIO_PACKET_SIZE - pkt->size;
     gxf_write_media_preamble(pb, ctx, pkt, pkt->size + padding);
-    if (sc->codec->codec_type == CODEC_TYPE_AUDIO)
-        put_buffer(pb, pkt->data, GXF_AUDIO_PACKET_SIZE);
-    else {
+    put_buffer(pb, pkt->data, pkt->size);
+    gxf_write_padding(pb, padding);
+    if (sc->codec->codec_type == CODEC_TYPE_VIDEO)
         ctx->field_number += 2;
-        put_buffer(pb, pkt->data, pkt->size);
-    }
-    gxf_write_padding(pb, padding);
     return updatePacketSize(pb, pos);
 }
 
@@ -793,11 +792,10 @@
             if (sc->codec->codec_type == CODEC_TYPE_AUDIO &&
                 (flush || fifo_size(&sc->audio_buffer, NULL) >= GXF_AUDIO_PACKET_SIZE)) {
                 int size = flush ? fifo_size(&sc->audio_buffer, NULL) : GXF_AUDIO_PACKET_SIZE;
-                av_new_packet(out, GXF_AUDIO_PACKET_SIZE);
+                av_new_packet(out, size);
                 fifo_read(&sc->audio_buffer, out->data, size, NULL);
                 gxf->audio_written++;
                 out->stream_index = i;
-                out->size = size;
                 return 1;
             }
         }