[FFmpeg-cvslog] avformat/rtpdec: return value check for init_get_bits()

[Limin Wang]

ffmpeg | branch: master | Limin Wang <lance.lmwang at gmail.com> | Sat Dec 25 11:15:40 2021 +0800| [c825de87c95ac4c70b9495268fcd26bd10dd0027] | committer: Limin Wang

avformat/rtpdec: return value check for init_get_bits()

Signed-off-by: Limin Wang <lance.lmwang at gmail.com>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=c825de87c95ac4c70b9495268fcd26bd10dd0027
---

 libavformat/rtpdec_h261.c         | 4 +++-
 libavformat/rtpdec_h263_rfc2190.c | 4 +++-
 libavformat/rtpdec_latm.c         | 4 +++-
 libavformat/rtpdec_mpeg4.c        | 5 ++++-
 libavformat/rtpdec_qt.c           | 4 +++-
 5 files changed, 16 insertions(+), 5 deletions(-)

diff --git a/libavformat/rtpdec_h261.c b/libavformat/rtpdec_h261.c
index a102909c60..57bc10fb3d 100644
--- a/libavformat/rtpdec_h261.c
+++ b/libavformat/rtpdec_h261.c
@@ -119,7 +119,9 @@ static int h261_handle_packet(AVFormatContext *ctx, PayloadContext *rtp_h261_ctx
         } else {
             /* ebit/sbit values inconsistent, assuming packet loss */
             GetBitContext gb;
-            init_get_bits(&gb, buf, len*8 - ebit);
+            res = init_get_bits(&gb, buf, len*8 - ebit);
+            if (res < 0)
+                return res;
             skip_bits(&gb, sbit);
             if (rtp_h261_ctx->endbyte_bits) {
                 rtp_h261_ctx->endbyte |= get_bits(&gb, 8 - rtp_h261_ctx->endbyte_bits);
diff --git a/libavformat/rtpdec_h263_rfc2190.c b/libavformat/rtpdec_h263_rfc2190.c
index a0f587f5c3..47aaec0fbc 100644
--- a/libavformat/rtpdec_h263_rfc2190.c
+++ b/libavformat/rtpdec_h263_rfc2190.c
@@ -142,7 +142,9 @@ static int h263_handle_packet(AVFormatContext *ctx, PayloadContext *data,
         } else {
             /* Start/end skip bits not matching - missed packets? */
             GetBitContext gb;
-            init_get_bits(&gb, buf, len*8 - ebit);
+            ret = init_get_bits(&gb, buf, len*8 - ebit);
+            if (ret < 0)
+                return ret;
             skip_bits(&gb, sbit);
             if (data->endbyte_bits) {
                 data->endbyte |= get_bits(&gb, 8 - data->endbyte_bits);
diff --git a/libavformat/rtpdec_latm.c b/libavformat/rtpdec_latm.c
index 104a00af18..329b8dbc3e 100644
--- a/libavformat/rtpdec_latm.c
+++ b/libavformat/rtpdec_latm.c
@@ -101,7 +101,9 @@ static int parse_fmtp_config(AVStream *st, const char *value)
     if (!config)
         return AVERROR(ENOMEM);
     ff_hex_to_data(config, value);
-    init_get_bits(&gb, config, len*8);
+    ret = init_get_bits(&gb, config, len*8);
+    if (ret < 0)
+        return ret;
     audio_mux_version = get_bits(&gb, 1);
     same_time_framing = get_bits(&gb, 1);
     skip_bits(&gb, 6); /* num_sub_frames */
diff --git a/libavformat/rtpdec_mpeg4.c b/libavformat/rtpdec_mpeg4.c
index 34c7950bcc..723b6fc6ed 100644
--- a/libavformat/rtpdec_mpeg4.c
+++ b/libavformat/rtpdec_mpeg4.c
@@ -124,6 +124,7 @@ static int rtp_parse_mp4_au(PayloadContext *data, const uint8_t *buf, int len)
 {
     int au_headers_length, au_header_size, i;
     GetBitContext getbitcontext;
+    int ret;
 
     if (len < 2)
         return AVERROR_INVALIDDATA;
@@ -144,7 +145,9 @@ static int rtp_parse_mp4_au(PayloadContext *data, const uint8_t *buf, int len)
     if (len < data->au_headers_length_bytes)
         return AVERROR_INVALIDDATA;
 
-    init_get_bits(&getbitcontext, buf, data->au_headers_length_bytes * 8);
+    ret = init_get_bits(&getbitcontext, buf, data->au_headers_length_bytes * 8);
+    if (ret < 0)
+        return ret;
 
     /* XXX: Wrong if optional additional sections are present (cts, dts etc...) */
     au_header_size = data->sizelength + data->indexlength;
diff --git a/libavformat/rtpdec_qt.c b/libavformat/rtpdec_qt.c
index 6723cd1bb0..495a3ec14e 100644
--- a/libavformat/rtpdec_qt.c
+++ b/libavformat/rtpdec_qt.c
@@ -82,7 +82,9 @@ static int qt_rtp_parse_packet(AVFormatContext *s, PayloadContext *qt,
      * The RTP payload is described in:
      * http://developer.apple.com/quicktime/icefloe/dispatch026.html
      */
-    init_get_bits(&gb, buf, len << 3);
+    ret = init_get_bits(&gb, buf, len << 3);
+    if (ret < 0)
+        return ret;
     ffio_init_context(&pb0, (uint8_t*)buf, len, 0, NULL, NULL, NULL, NULL);
 
     if (len < 4)