[FFmpeg-cvslog] avformat/mov: strengthen some table allocations
Clément Bœsch
git at videolan.org
Sat Dec 20 12:09:07 CET 2014
ffmpeg | branch: release/2.4 | Clément Bœsch <clement at stupeflix.com> | Mon Nov 10 18:21:28 2014 +0100| [47e4a1ac6d1c0ed32f28ed6922ce9a08965f4473] | committer: Michael Niedermayer
avformat/mov: strengthen some table allocations
(cherry picked from commit 5ab882d7283f57560c889919c35f2688253b1d9c)
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=47e4a1ac6d1c0ed32f28ed6922ce9a08965f4473
---
libavformat/mov.c | 48 +++++++++++++++++++++++++++---------------------
1 file changed, 27 insertions(+), 21 deletions(-)
diff --git a/libavformat/mov.c b/libavformat/mov.c
index 2ccb030..397e8df 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -1174,14 +1174,12 @@ static int mov_read_stco(MOVContext *c, AVIOContext *pb, MOVAtom atom)
if (!entries)
return 0;
- if (entries >= UINT_MAX/sizeof(int64_t))
- return AVERROR_INVALIDDATA;
if (sc->chunk_offsets)
av_log(c->fc, AV_LOG_WARNING, "Duplicate STCO atom\n");
av_free(sc->chunk_offsets);
sc->chunk_count = 0;
- sc->chunk_offsets = av_malloc(entries * sizeof(int64_t));
+ sc->chunk_offsets = av_malloc_array(entries, sizeof(*sc->chunk_offsets));
if (!sc->chunk_offsets)
return AVERROR(ENOMEM);
sc->chunk_count = entries;
@@ -1770,13 +1768,11 @@ static int mov_read_stsc(MOVContext *c, AVIOContext *pb, MOVAtom atom)
if (!entries)
return 0;
- if (entries >= UINT_MAX / sizeof(*sc->stsc_data))
- return AVERROR_INVALIDDATA;
if (sc->stsc_data)
av_log(c->fc, AV_LOG_WARNING, "Duplicate STSC atom\n");
av_free(sc->stsc_data);
sc->stsc_count = 0;
- sc->stsc_data = av_malloc(entries * sizeof(*sc->stsc_data));
+ sc->stsc_data = av_malloc_array(entries, sizeof(*sc->stsc_data));
if (!sc->stsc_data)
return AVERROR(ENOMEM);
@@ -1808,9 +1804,11 @@ static int mov_read_stps(MOVContext *c, AVIOContext *pb, MOVAtom atom)
avio_rb32(pb); // version + flags
entries = avio_rb32(pb);
- if (entries >= UINT_MAX / sizeof(*sc->stps_data))
- return AVERROR_INVALIDDATA;
- sc->stps_data = av_malloc(entries * sizeof(*sc->stps_data));
+ if (sc->stps_data)
+ av_log(c->fc, AV_LOG_WARNING, "Duplicate STPS atom\n");
+ av_free(sc->stps_data);
+ sc->stps_count = 0;
+ sc->stps_data = av_malloc_array(entries, sizeof(*sc->stps_data));
if (!sc->stps_data)
return AVERROR(ENOMEM);
@@ -1852,9 +1850,11 @@ static int mov_read_stss(MOVContext *c, AVIOContext *pb, MOVAtom atom)
st->need_parsing = AVSTREAM_PARSE_HEADERS;
return 0;
}
- if (entries >= UINT_MAX / sizeof(int))
- return AVERROR_INVALIDDATA;
- sc->keyframes = av_malloc(entries * sizeof(int));
+ if (sc->keyframes)
+ av_log(c->fc, AV_LOG_WARNING, "Duplicate STSS atom\n");
+ av_free(sc->keyframes);
+ sc->keyframe_count = 0;
+ sc->keyframes = av_malloc_array(entries, sizeof(*sc->keyframes));
if (!sc->keyframes)
return AVERROR(ENOMEM);
@@ -1913,9 +1913,13 @@ static int mov_read_stsz(MOVContext *c, AVIOContext *pb, MOVAtom atom)
if (!entries)
return 0;
- if (entries >= UINT_MAX / sizeof(int) || entries >= (UINT_MAX - 4) / field_size)
+ if (entries >= (UINT_MAX - 4) / field_size)
return AVERROR_INVALIDDATA;
- sc->sample_sizes = av_malloc(entries * sizeof(int));
+ if (sc->sample_sizes)
+ av_log(c->fc, AV_LOG_WARNING, "Duplicate STSZ atom\n");
+ av_free(sc->sample_sizes);
+ sc->sample_count = 0;
+ sc->sample_sizes = av_malloc_array(entries, sizeof(*sc->sample_sizes));
if (!sc->sample_sizes)
return AVERROR(ENOMEM);
@@ -1969,11 +1973,11 @@ static int mov_read_stts(MOVContext *c, AVIOContext *pb, MOVAtom atom)
av_dlog(c->fc, "track[%i].stts.entries = %i\n",
c->fc->nb_streams-1, entries);
- if (entries >= UINT_MAX / sizeof(*sc->stts_data))
- return -1;
-
+ if (sc->stts_data)
+ av_log(c->fc, AV_LOG_WARNING, "Duplicate STTS atom\n");
av_free(sc->stts_data);
- sc->stts_data = av_malloc(entries * sizeof(*sc->stts_data));
+ sc->stts_count = 0;
+ sc->stts_data = av_malloc_array(entries, sizeof(*sc->stts_data));
if (!sc->stts_data)
return AVERROR(ENOMEM);
@@ -2112,9 +2116,11 @@ static int mov_read_sbgp(MOVContext *c, AVIOContext *pb, MOVAtom atom)
entries = avio_rb32(pb);
if (!entries)
return 0;
- if (entries >= UINT_MAX / sizeof(*sc->rap_group))
- return AVERROR_INVALIDDATA;
- sc->rap_group = av_malloc(entries * sizeof(*sc->rap_group));
+ if (sc->rap_group)
+ av_log(c->fc, AV_LOG_WARNING, "Duplicate SBGP atom\n");
+ av_free(sc->rap_group);
+ sc->rap_group_count = 0;
+ sc->rap_group = av_malloc_array(entries, sizeof(*sc->rap_group));
if (!sc->rap_group)
return AVERROR(ENOMEM);
More information about the ffmpeg-cvslog
mailing list