112 lines
4.9 KiB
Plaintext
112 lines
4.9 KiB
Plaintext
$OpenBSD: patch-libavformat_matroskadec_c,v 1.1 2011/08/03 18:44:07 dcoppa Exp $
|
|
|
|
- Clear current_id when avio_seek happens in matroska_read_seek.
|
|
- Fix integer underflow if header length < probe length.
|
|
- Fix several security issues. MSVR-11-0080
|
|
|
|
--- libavformat/matroskadec.c.orig Sat Jul 30 00:54:11 2011
|
|
+++ libavformat/matroskadec.c Sat Jul 30 01:05:15 2011
|
|
@@ -797,11 +797,15 @@ static int ebml_parse_elem(MatroskaDemuxContext *matro
|
|
uint32_t id = syntax->id;
|
|
uint64_t length;
|
|
int res;
|
|
+ void *newelem;
|
|
|
|
data = (char *)data + syntax->data_offset;
|
|
if (syntax->list_elem_size) {
|
|
EbmlList *list = data;
|
|
- list->elem = av_realloc(list->elem, (list->nb_elem+1)*syntax->list_elem_size);
|
|
+ newelem = av_realloc(list->elem, (list->nb_elem+1)*syntax->list_elem_size);
|
|
+ if (!newelem)
|
|
+ return AVERROR(ENOMEM);
|
|
+ list->elem = newelem;
|
|
data = (char*)list->elem + list->nb_elem*syntax->list_elem_size;
|
|
memset(data, 0, syntax->list_elem_size);
|
|
list->nb_elem++;
|
|
@@ -899,6 +903,8 @@ static int matroska_probe(AVProbeData *p)
|
|
* Not fully fool-proof, but good enough. */
|
|
for (i = 0; i < FF_ARRAY_ELEMS(matroska_doctypes); i++) {
|
|
int probelen = strlen(matroska_doctypes[i]);
|
|
+ if (total < probelen)
|
|
+ continue;
|
|
for (n = 4+size; n <= 4+size+total-probelen; n++)
|
|
if (!memcmp(p->buf+n, matroska_doctypes[i], probelen))
|
|
return AVPROBE_SCORE_MAX;
|
|
@@ -961,7 +967,10 @@ static int matroska_decode_buffer(uint8_t** buf, int*
|
|
pkt_data = av_realloc(pkt_data, pkt_size);
|
|
zstream.avail_out = pkt_size - zstream.total_out;
|
|
zstream.next_out = pkt_data + zstream.total_out;
|
|
- result = inflate(&zstream, Z_NO_FLUSH);
|
|
+ if (pkt_data) {
|
|
+ result = inflate(&zstream, Z_NO_FLUSH);
|
|
+ } else
|
|
+ result = Z_MEM_ERROR;
|
|
} while (result==Z_OK && pkt_size<10000000);
|
|
pkt_size = zstream.total_out;
|
|
inflateEnd(&zstream);
|
|
@@ -982,7 +991,10 @@ static int matroska_decode_buffer(uint8_t** buf, int*
|
|
pkt_data = av_realloc(pkt_data, pkt_size);
|
|
bzstream.avail_out = pkt_size - bzstream.total_out_lo32;
|
|
bzstream.next_out = pkt_data + bzstream.total_out_lo32;
|
|
- result = BZ2_bzDecompress(&bzstream);
|
|
+ if (pkt_data) {
|
|
+ result = BZ2_bzDecompress(&bzstream);
|
|
+ } else
|
|
+ result = BZ_MEM_ERROR;
|
|
} while (result==BZ_OK && pkt_size<10000000);
|
|
pkt_size = bzstream.total_out_lo32;
|
|
BZ2_bzDecompressEnd(&bzstream);
|
|
@@ -1034,13 +1046,17 @@ static void matroska_fix_ass_packet(MatroskaDemuxConte
|
|
}
|
|
}
|
|
|
|
-static void matroska_merge_packets(AVPacket *out, AVPacket *in)
|
|
+static int matroska_merge_packets(AVPacket *out, AVPacket *in)
|
|
{
|
|
- out->data = av_realloc(out->data, out->size+in->size);
|
|
+ void *newdata = av_realloc(out->data, out->size+in->size);
|
|
+ if (!newdata)
|
|
+ return AVERROR(ENOMEM);
|
|
+ out->data = newdata;
|
|
memcpy(out->data+out->size, in->data, in->size);
|
|
out->size += in->size;
|
|
av_destruct_packet(in);
|
|
av_free(in);
|
|
+ return 0;
|
|
}
|
|
|
|
static void matroska_convert_tag(AVFormatContext *s, EbmlList *list,
|
|
@@ -1562,11 +1578,13 @@ static int matroska_deliver_packet(MatroskaDemuxContex
|
|
memcpy(pkt, matroska->packets[0], sizeof(AVPacket));
|
|
av_free(matroska->packets[0]);
|
|
if (matroska->num_packets > 1) {
|
|
+ void *newpackets;
|
|
memmove(&matroska->packets[0], &matroska->packets[1],
|
|
(matroska->num_packets - 1) * sizeof(AVPacket *));
|
|
- matroska->packets =
|
|
- av_realloc(matroska->packets, (matroska->num_packets - 1) *
|
|
- sizeof(AVPacket *));
|
|
+ newpackets = av_realloc(matroska->packets,
|
|
+ (matroska->num_packets - 1) * sizeof(AVPacket *));
|
|
+ if (newpackets)
|
|
+ matroska->packets = newpackets;
|
|
} else {
|
|
av_freep(&matroska->packets);
|
|
}
|
|
@@ -1897,6 +1915,7 @@ static int matroska_read_seek(AVFormatContext *s, int
|
|
|
|
if ((index = av_index_search_timestamp(st, timestamp, flags)) < 0) {
|
|
avio_seek(s->pb, st->index_entries[st->nb_index_entries-1].pos, SEEK_SET);
|
|
+ matroska->current_id = 0;
|
|
while ((index = av_index_search_timestamp(st, timestamp, flags)) < 0) {
|
|
matroska_clear_queue(matroska);
|
|
if (matroska_parse_cluster(matroska) < 0)
|
|
@@ -1925,6 +1944,7 @@ static int matroska_read_seek(AVFormatContext *s, int
|
|
}
|
|
|
|
avio_seek(s->pb, st->index_entries[index_min].pos, SEEK_SET);
|
|
+ matroska->current_id = 0;
|
|
matroska->skip_to_keyframe = !(flags & AVSEEK_FLAG_ANY);
|
|
matroska->skip_to_timecode = st->index_entries[index].timestamp;
|
|
matroska->done = 0;
|