comparison libmpdemux/demux_real.c @ 18444:fa603193eccf

Fix potential integer overflows in memory allocation. Patch by Reimar and me, SIZE_MAX by Rich

18443:1bcd97461b7b

    float *audio_timestamp; ///< timestamp for each audio packet
    int sub_packet_cnt; ///< number of subpacket already received
    int audio_filepos; ///< file position of first audio packet in block
} real_priv_t;

/* originally from FFmpeg */
static void get_str(int isbyte, demuxer_t *demuxer, char *buf, int buf_size)
{
    int len;
    

    stream_id = stream_read_word(demuxer->stream);
    mp_msg(MSGT_DEMUX, MSGL_V,"stream_id: %d\n", stream_id);
    
    next_header_pos = stream_read_dword(demuxer->stream);
    mp_msg(MSGT_DEMUX, MSGL_V,"next_header_pos: %d\n", next_header_pos);
    if (entries <= 0)
    {
	if (next_header_pos)
	    goto read_index;
	i = entries;
	goto end;
    }

    priv->index_table_size[stream_id] = entries;
    priv->index_table[stream_id] = malloc(priv->index_table_size[stream_id] * sizeof(real_index_table_t));
    
    for (i = 0; i < entries; i++)
    {
	stream_skip(demuxer->stream, 2); /* version */
	priv->index_table[stream_id][i].timestamp = stream_read_dword(demuxer->stream);

{
  if ((unsigned)stream_id < MAX_STREAMS)
  {
    real_priv_t *priv = demuxer->priv;
    real_index_table_t *index;
    if (priv->index_table_size[stream_id] >= priv->index_malloc_size[stream_id])
    {
      if (priv->index_malloc_size[stream_id] == 0)
	priv->index_malloc_size[stream_id] = 2048;
      else

18444:fa603193eccf

    float *audio_timestamp; ///< timestamp for each audio packet
    int sub_packet_cnt; ///< number of subpacket already received
    int audio_filepos; ///< file position of first audio packet in block
} real_priv_t;

//! use at most 200 MB of memory for index, corresponds to around 25 million entries
#define MAX_INDEX_ENTRIES (200*1024*1024 / sizeof(real_index_table_t))

/* originally from FFmpeg */
static void get_str(int isbyte, demuxer_t *demuxer, char *buf, int buf_size)
{
    int len;
    

    stream_id = stream_read_word(demuxer->stream);
    mp_msg(MSGT_DEMUX, MSGL_V,"stream_id: %d\n", stream_id);
    
    next_header_pos = stream_read_dword(demuxer->stream);
    mp_msg(MSGT_DEMUX, MSGL_V,"next_header_pos: %d\n", next_header_pos);
    if (entries <= 0 || entries > MAX_INDEX_ENTRIES)
    {
	if (next_header_pos)
	    goto read_index;
	i = entries;
	goto end;
    }

    priv->index_table_size[stream_id] = entries;
    priv->index_table[stream_id] = calloc(priv->index_table_size[stream_id], sizeof(real_index_table_t));
    
    for (i = 0; i < entries; i++)
    {
	stream_skip(demuxer->stream, 2); /* version */
	priv->index_table[stream_id][i].timestamp = stream_read_dword(demuxer->stream);

{
  if ((unsigned)stream_id < MAX_STREAMS)
  {
    real_priv_t *priv = demuxer->priv;
    real_index_table_t *index;
    if (priv->index_table_size[stream_id] >= MAX_INDEX_ENTRIES) {
      mp_msg(MSGT_DEMUXER, MSGL_WARN, "Index too large during building\n");
      return;
    }
    if (priv->index_table_size[stream_id] >= priv->index_malloc_size[stream_id])
    {
      if (priv->index_malloc_size[stream_id] == 0)
	priv->index_malloc_size[stream_id] = 2048;
      else