[MPlayer-cvslog] r37591 - in branches/1.2: . libmpcodecs/ad_hwac3.c libmpcodecs/ad_imaadpcm.c libmpcodecs/dec_audio.c libmpcodecs/mp_image.c libmpcodecs/vf.c libmpdemux/demux_gif.c

rtogni subversion at mplayerhq.hu
Fri Jan 8 13:28:32 CET 2016


Author: rtogni
Date: Fri Jan  8 13:28:31 2016
New Revision: 37591

Log:
Merge r37583 - r37590 from trunk

-ad_hwac3: Fix access to NULL demuxer buffer by demux_getc()
-ad_imaadpcm: MS/QT IMA ADCPM and DK4 ADPCM can have only 1 or 2 channels
-demux_gif: do not crash on missing colormap.
-Make gif detection more robust in demuxer_gif.
-demux_gif: do not crash on broken graphic extension block.
-Sanitize audio parameters and prevent int32 overflow while calculating the
size of the codec ouput buffer.
-Sanitize image parameters and prevent int32 overflow while calculating the
size of the picture  buffer.
-Prevent overflow in picture size buffer allocation also for the IF09 case

Modified:
   branches/1.2/   (props changed)
   branches/1.2/libmpcodecs/ad_hwac3.c
   branches/1.2/libmpcodecs/ad_imaadpcm.c
   branches/1.2/libmpcodecs/dec_audio.c
   branches/1.2/libmpcodecs/mp_image.c
   branches/1.2/libmpcodecs/vf.c
   branches/1.2/libmpdemux/demux_gif.c

Modified: branches/1.2/libmpcodecs/ad_hwac3.c
==============================================================================
--- branches/1.2/libmpcodecs/ad_hwac3.c	Fri Jan  8 00:38:44 2016	(r37590)
+++ branches/1.2/libmpcodecs/ad_hwac3.c	Fri Jan  8 13:28:31 2016	(r37591)
@@ -168,6 +168,11 @@ static int preinit(sh_audio_t *sh)
 
 static int init(sh_audio_t *sh_audio)
 {
+  demux_stream_t *ds = sh_audio->ds;
+
+  /* Ensure that the demuxer buffer is not empty */
+  if(ds->buffer_pos >= ds->buffer_size && !ds_fill_buffer(ds))
+    return 0;
   /* Dolby AC3 passthrough:*/
   if(ac3dts_fillbuff(sh_audio) < 0)
   {

Modified: branches/1.2/libmpcodecs/ad_imaadpcm.c
==============================================================================
--- branches/1.2/libmpcodecs/ad_imaadpcm.c	Fri Jan  8 00:38:44 2016	(r37590)
+++ branches/1.2/libmpcodecs/ad_imaadpcm.c	Fri Jan  8 13:28:31 2016	(r37591)
@@ -92,6 +92,10 @@ static int preinit(sh_audio_t *sh_audio)
   // not exactly sure what this field is for
   sh_audio->audio_out_minsize = 8192;
 
+  // These formats can have only 1 or 2 channels
+  if (sh_audio->wf->nChannels != 1 && sh_audio->wf->nChannels != 2)
+    return 0;
+
   // if format is "ima4", assume the audio is coming from a QT file which
   // indicates constant block size, whereas an AVI/ASF/WAV file will fill
   // in this field with 0x11

Modified: branches/1.2/libmpcodecs/dec_audio.c
==============================================================================
--- branches/1.2/libmpcodecs/dec_audio.c	Fri Jan  8 00:38:44 2016	(r37590)
+++ branches/1.2/libmpcodecs/dec_audio.c	Fri Jan  8 13:28:31 2016	(r37591)
@@ -118,6 +118,14 @@ static int init_audio_codec(sh_audio_t *
 	return 0;
     }
 
+    if (sh_audio->channels < 0 || sh_audio->samplerate < 0 || sh_audio->samplesize < 0 ||
+	(int64_t)sh_audio->channels * sh_audio->samplerate > INT_MAX ||
+	(int64_t)sh_audio->channels * sh_audio->samplerate * sh_audio->samplesize > INT_MAX) {
+	mp_msg(MSGT_DECAUDIO, MSGL_WARN, "dec_audio: Unreasonable audio codec parameters\n");
+	uninit_audio(sh_audio);	// free buffers
+	return 0;
+    }
+
     if (!sh_audio->o_bps)
 	sh_audio->o_bps = sh_audio->channels * sh_audio->samplerate
 	                  * sh_audio->samplesize;

Modified: branches/1.2/libmpcodecs/mp_image.c
==============================================================================
--- branches/1.2/libmpcodecs/mp_image.c	Fri Jan  8 00:38:44 2016	(r37590)
+++ branches/1.2/libmpcodecs/mp_image.c	Fri Jan  8 13:28:31 2016	(r37591)
@@ -33,8 +33,22 @@
 #include "mp_msg.h"
 
 void mp_image_alloc_planes(mp_image_t *mpi) {
+  /* This condition is stricter than needed, but I want to be sure that every
+   * calculation step can fit in int32_t. This assumption is true over most of
+   * the code, so this acts as a safeguard for other image size calulations. */
+  if ((unsigned int)mpi->height + 2 > INT_MAX ||
+      (int64_t)mpi->width*(mpi->height+2) > INT_MAX ||
+      (int64_t)mpi->bpp*mpi->width*(mpi->height+2) > INT_MAX) {
+      mp_msg(MSGT_DECVIDEO,MSGL_WARN,"mp_image: Unreasonable image parameters\n");
+      return;
+  }
   // IF09 - allocate space for 4. plane delta info - unused
   if (mpi->imgfmt == IMGFMT_IF09) {
+    if ((int64_t)mpi->chroma_width*mpi->chroma_height > INT_MAX ||
+        mpi->bpp*mpi->width*(mpi->height+2)/8 > INT_MAX - mpi->chroma_width*mpi->chroma_height) {
+        mp_msg(MSGT_DECVIDEO,MSGL_WARN,"mp_image: Unreasonable image parameters\n");
+        return;
+  }
     mpi->planes[0]=av_malloc(mpi->bpp*mpi->width*(mpi->height+2)/8+
                             mpi->chroma_width*mpi->chroma_height);
   } else

Modified: branches/1.2/libmpcodecs/vf.c
==============================================================================
--- branches/1.2/libmpcodecs/vf.c	Fri Jan  8 00:38:44 2016	(r37590)
+++ branches/1.2/libmpcodecs/vf.c	Fri Jan  8 13:28:31 2016	(r37591)
@@ -294,6 +294,11 @@ mp_image_t* vf_get_image(vf_instance_t*
   if (w == -1) w = vf->w;
   if (h == -1) h = vf->h;
 
+  if (w < 0 || h < 0 || w > INT_MAX - 32) {
+      mp_msg(MSGT_DECVIDEO, MSGL_ERR, "vf_get_image: unreasonable picture size\n");
+      return NULL;
+  }
+
   w2=(mp_imgflag&MP_IMGFLAG_ACCEPT_ALIGNED_STRIDE)?FFALIGN(w, 32):w;
 
   if(vf->put_image==vf_next_put_image){
@@ -411,6 +416,11 @@ mp_image_t* vf_get_image(vf_instance_t*
           }
 
           mp_image_alloc_planes(mpi);
+          if (!(mpi->flags & MP_IMGFLAG_ALLOCATED)) { // allocation failed
+              mp_msg(MSGT_DECVIDEO, MSGL_FATAL, "vf_get_image: allocation of image planes failed!\n");
+              return NULL;
+          }
+
 //        printf("clearing img!\n");
           vf_mpi_clear(mpi,0,0,mpi->width,mpi->height);
         }

Modified: branches/1.2/libmpdemux/demux_gif.c
==============================================================================
--- branches/1.2/libmpdemux/demux_gif.c	Fri Jan  8 00:38:44 2016	(r37590)
+++ branches/1.2/libmpdemux/demux_gif.c	Fri Jan  8 13:28:31 2016	(r37591)
@@ -43,7 +43,7 @@ typedef struct {
   uint8_t *refimg;
 } gif_priv_t;
 
-#define GIF_SIGNATURE (('G' << 16) | ('I' << 8) | 'F')
+#define GIF_SIGNATURE (('G' << 24) | ('I' << 16) | ('F' << 8) | '8')
 
 #if defined GIFLIB_MAJOR && GIFLIB_MAJOR >= 5
 #define DGifOpen(a, b) DGifOpen(a, b, NULL)
@@ -84,8 +84,11 @@ static int my_read_gif(GifFileType *gif,
 
 static int gif_check_file(demuxer_t *demuxer)
 {
-  if (stream_read_int24(demuxer->stream) == GIF_SIGNATURE)
-    return DEMUXER_TYPE_GIF;
+  if (stream_read_dword(demuxer->stream) == GIF_SIGNATURE) {
+    int sig = stream_read_word(demuxer->stream);
+    if ((((sig & 0xff00) == 0x3700) || ((sig & 0xff00) == 0x3900)) && (sig & 0xff) == 'a')
+      return DEMUXER_TYPE_GIF;
+  }
   return 0;
 }
 
@@ -143,7 +146,7 @@ static int demux_gif_fill_buffer(demuxer
       }
       if (code == 0xF9) {
         int frametime = 0;
-        if (p[0] == 4) // is the length correct?
+        if (p && p[0] == 4) // is the length correct?
         {
           transparency = p[1] & 1;
           refmode = (p[1] >> 2) & 3;
@@ -204,6 +207,11 @@ static int demux_gif_fill_buffer(demuxer
 
   effective_map = gif->Image.ColorMap;
   if (effective_map == NULL) effective_map = gif->SColorMap;
+  if (effective_map == NULL) {
+    mp_msg(MSGT_DEMUX, MSGL_ERR, "[demux_gif] No local nor global colormap.\n");
+    free(buf);
+    return 0;
+  }
 
   {
     int y;


More information about the MPlayer-cvslog mailing list