Unified · Split
| @@ -16,6 +16,7 @@ · 15 unmodified lines | ||
| 16 | 16 | * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA |
| 17 | 17 | */ |
| 18 | 18 | |
| 19 | +#include "libavutil/opt.h" | |
| 19 | 20 | #include "libavcodec/codec.h" |
| 20 | 21 | #include "libavcodec/codec_desc.h" |
| 21 | 22 | |
| @@ -34,6 +35,25 @@ do { \ · 12 unmodified lines | ||
| 34 | 35 | #define ERR(msg) ERR_INTERNAL(msg, ) |
| 35 | 36 | #define ERR_EXT(msg, ...) ERR_INTERNAL(msg, , __VA_ARGS__) |
| 36 | 37 | |
| 38 | +static int priv_data_size_wrong(const AVCodec *codec) | |
| 39 | +{ | |
| 40 | + if (codec->priv_data_size < 0 || | |
| 41 | + codec->priv_class && codec->priv_data_size < sizeof(AVClass*)) | |
| 42 | + return 1; | |
| 43 | + if (!codec->priv_class || !codec->priv_class->option) | |
| 44 | + return 0; | |
| 45 | + for (const AVOption *opt = codec->priv_class->option; opt->name; opt++) { | |
| 46 | + if (opt->offset >= codec->priv_data_size || | |
| 47 | + opt->type == AV_OPT_TYPE_CONST && opt->offset != 0 || | |
| 48 | + opt->type != AV_OPT_TYPE_CONST && (opt->offset < sizeof(AVClass*) || opt->offset < 0)) { | |
| 49 | + AV_LOG("Option %s offset %d nonsensical\n", | |
| 50 | + opt->name, opt->offset); | |
| 51 | + return 1; | |
| 52 | + } | |
| 53 | + } | |
| 54 | + return 0; | |
| 55 | +} | |
| 56 | + | |
| 37 | 57 | int main(void){ |
| 38 | 58 | void *iter = NULL; |
| 39 | 59 | const AVCodec *codec = NULL; |
| @@ -92,6 +112,9 @@ int main(void){ · 52 unmodified lines | ||
| 92 | 112 | if (!!codec->decode + !!codec->receive_frame != 1) |
| 93 | 113 | ERR("Decoder %s does not implement exactly one decode API.\n"); |
| 94 | 114 | } |
| 115 | + if (priv_data_size_wrong(codec)) | |
| 116 | + ERR_EXT("Private context of codec %s is impossibly-sized (size %d).", | |
| 117 | + codec->priv_data_size); | |
| 95 | 118 | if (!(desc = avcodec_descriptor_get(codec->id))) { |
| 96 | 119 | ERR("Codec %s lacks a corresponding descriptor\n"); |
| 97 | 120 | } else if (desc->type != codec->type) |