[FFmpeg-cvslog] r19192 - in trunk: libavcodec/dv.c libavcodec/dvdata.h libavformat/dv.c

[bcoudurier]

Author: bcoudurier
Date: Mon Jun 15 00:34:28 2009
New Revision: 19192

Log:
check if frame size matches old sys and assumes corrupted input, fixes #1192

Modified:
   trunk/libavcodec/dv.c
   trunk/libavcodec/dvdata.h
   trunk/libavformat/dv.c

Modified: trunk/libavcodec/dv.c
==============================================================================
--- trunk/libavcodec/dv.c	Sun Jun 14 16:49:46 2009	(r19191)
+++ trunk/libavcodec/dv.c	Mon Jun 15 00:34:28 2009	(r19192)
@@ -1119,7 +1119,7 @@ static int dvvideo_decode_frame(AVCodecC
     int buf_size = avpkt->size;
     DVVideoContext *s = avctx->priv_data;
 
-    s->sys = dv_frame_profile(buf);
+    s->sys = dv_frame_profile(s->sys, buf, buf_size);
     if (!s->sys || buf_size < s->sys->frame_size || dv_init_dynamic_tables(s->sys))
         return -1; /* NOTE: we only accept several full frames */
 

Modified: trunk/libavcodec/dvdata.h
==============================================================================
--- trunk/libavcodec/dvdata.h	Sun Jun 14 16:49:46 2009	(r19191)
+++ trunk/libavcodec/dvdata.h	Mon Jun 15 00:34:28 2009	(r19192)
@@ -698,7 +698,9 @@ enum dv_pack_type {
  */
 #define DV_MAX_BPM 8
 
-static inline const DVprofile* dv_frame_profile(const uint8_t* frame)
+static inline
+const DVprofile* dv_frame_profile(const DVprofile *sys,
+                                  const uint8_t* frame, unsigned buf_size)
 {
    int i;
 
@@ -715,6 +717,10 @@ static inline const DVprofile* dv_frame_
        if (dsf == dv_profiles[i].dsf && stype == dv_profiles[i].video_stype)
            return &dv_profiles[i];
 
+   /* check if old sys matches and assumes corrupted input */
+   if (sys && buf_size == sys->frame_size)
+       return sys;
+
    return NULL;
 }
 

Modified: trunk/libavformat/dv.c
==============================================================================
--- trunk/libavformat/dv.c	Sun Jun 14 16:49:46 2009	(r19191)
+++ trunk/libavformat/dv.c	Mon Jun 15 00:34:28 2009	(r19192)
@@ -322,7 +322,7 @@ int dv_produce_packet(DVDemuxContext *c,
     uint8_t *ppcm[4] = {0};
 
     if (buf_size < DV_PROFILE_BYTES ||
-        !(c->sys = dv_frame_profile(buf)) ||
+        !(c->sys = dv_frame_profile(c->sys, buf, buf_size)) ||
         buf_size < c->sys->frame_size) {
           return -1;   /* Broken frame, or not enough data */
     }
@@ -421,7 +421,7 @@ static int dv_read_header(AVFormatContex
         url_fseek(s->pb, -DV_PROFILE_BYTES, SEEK_CUR) < 0)
         return AVERROR(EIO);
 
-    c->dv_demux->sys = dv_frame_profile(c->buf);
+    c->dv_demux->sys = dv_frame_profile(c->dv_demux->sys, c->buf, DV_PROFILE_BYTES);
     if (!c->dv_demux->sys) {
         av_log(s, AV_LOG_ERROR, "Can't determine profile of DV input stream.\n");
         return -1;