Whitespace of the patch cleaned up by Aurel Some of the issues have been reported by Steve Manzuik / Microsoft Vulnerability Research (MSVR) Signed-off-by: Michael Niedermayer <michaelni@gmx.at> (cherry picked from commit 956c901c68eff78288f40e3c8f41ee2fa081d4a8) Further suggestions from Kostya <kostya.shishkov@gmail.com> have been implemented by Reinhard Tartler <siretart@tauware.de>
Unified · Split
| @@ -801,11 +801,15 @@ static int ebml_parse_elem(MatroskaDemuxContext *matroska, · 800 unmodified lines | ||
| 801 | 801 | uint32_t id = syntax->id; |
| 802 | 802 | uint64_t length; |
| 803 | 803 | int res; |
| 804 | + void *newelem; | |
| 804 | 805 | |
| 805 | 806 | data = (char *)data + syntax->data_offset; |
| 806 | 807 | if (syntax->list_elem_size) { |
| 807 | 808 | EbmlList *list = data; |
| 808 | − list->elem = av_realloc(list->elem, (list->nb_elem+1)*syntax->list_elem_size); | |
| 809 | + newelem = av_realloc(list->elem, (list->nb_elem+1)*syntax->list_elem_size); | |
| 810 | + if (!newelem) | |
| 811 | + return AVERROR(ENOMEM); | |
| 812 | + list->elem = newelem; | |
| 809 | 813 | data = (char*)list->elem + list->nb_elem*syntax->list_elem_size; |
| 810 | 814 | memset(data, 0, syntax->list_elem_size); |
| 811 | 815 | list->nb_elem++; |
| @@ -935,6 +939,7 @@ static int matroska_decode_buffer(uint8_t** buf, int* buf_size, · 123 unmodified lines | ||
| 935 | 939 | uint8_t* data = *buf; |
| 936 | 940 | int isize = *buf_size; |
| 937 | 941 | uint8_t* pkt_data = NULL; |
| 942 | + uint8_t* newpktdata; | |
| 938 | 943 | int pkt_size = isize; |
| 939 | 944 | int result = 0; |
| 940 | 945 | int olen; |
| @@ -964,7 +969,12 @@ static int matroska_decode_buffer(uint8_t** buf, int* buf_size, · 23 unmodified lines | ||
| 964 | 969 | zstream.avail_in = isize; |
| 965 | 970 | do { |
| 966 | 971 | pkt_size *= 3; |
| 967 | − pkt_data = av_realloc(pkt_data, pkt_size); | |
| 972 | + newpktdata = av_realloc(pkt_data, pkt_size); | |
| 973 | + if (!newpktdata) { | |
| 974 | + inflateEnd(&zstream); | |
| 975 | + goto failed; | |
| 976 | + } | |
| 977 | + pkt_data = newpktdata; | |
| 968 | 978 | zstream.avail_out = pkt_size - zstream.total_out; |
| 969 | 979 | zstream.next_out = pkt_data + zstream.total_out; |
| 970 | 980 | result = inflate(&zstream, Z_NO_FLUSH); |
| @@ -985,7 +995,12 @@ static int matroska_decode_buffer(uint8_t** buf, int* buf_size, · 14 unmodified lines | ||
| 985 | 995 | bzstream.avail_in = isize; |
| 986 | 996 | do { |
| 987 | 997 | pkt_size *= 3; |
| 988 | − pkt_data = av_realloc(pkt_data, pkt_size); | |
| 998 | + newpktdata = av_realloc(pkt_data, pkt_size); | |
| 999 | + if (!newpktdata) { | |
| 1000 | + BZ2_bzDecompressEnd(&bzstream); | |
| 1001 | + goto failed; | |
| 1002 | + } | |
| 1003 | + pkt_data = newpktdata; | |
| 989 | 1004 | bzstream.avail_out = pkt_size - bzstream.total_out_lo32; |
| 990 | 1005 | bzstream.next_out = pkt_data + bzstream.total_out_lo32; |
| 991 | 1006 | result = BZ2_bzDecompress(&bzstream); |
| @@ -1040,13 +1055,17 @@ static void matroska_fix_ass_packet(MatroskaDemuxContext *matroska, · 48 unmodified lines | ||
| 1040 | 1055 | } |
| 1041 | 1056 | } |
| 1042 | 1057 | |
| 1043 | −static void matroska_merge_packets(AVPacket *out, AVPacket *in) | |
| 1058 | +static int matroska_merge_packets(AVPacket *out, AVPacket *in) | |
| 1044 | 1059 | { |
| 1045 | − out->data = av_realloc(out->data, out->size+in->size); | |
| 1060 | + void *newdata = av_realloc(out->data, out->size+in->size); | |
| 1061 | + if (!newdata) | |
| 1062 | + return AVERROR(ENOMEM); | |
| 1063 | + out->data = newdata; | |
| 1046 | 1064 | memcpy(out->data+out->size, in->data, in->size); |
| 1047 | 1065 | out->size += in->size; |
| 1048 | 1066 | av_destruct_packet(in); |
| 1049 | 1067 | av_free(in); |
| 1068 | + return 0; | |
| 1050 | 1069 | } |
| 1051 | 1070 | |
| 1052 | 1071 | static void matroska_convert_tag(AVFormatContext *s, EbmlList *list, |
| @@ -1604,11 +1623,13 @@ static int matroska_deliver_packet(MatroskaDemuxContext *matroska, · 551 unmodified lines | ||
| 1604 | 1623 | memcpy(pkt, matroska->packets[0], sizeof(AVPacket)); |
| 1605 | 1624 | av_free(matroska->packets[0]); |
| 1606 | 1625 | if (matroska->num_packets > 1) { |
| 1626 | + void *newpackets; | |
| 1607 | 1627 | memmove(&matroska->packets[0], &matroska->packets[1], |
| 1608 | 1628 | (matroska->num_packets - 1) * sizeof(AVPacket *)); |
| 1609 | − matroska->packets = | |
| 1610 | − av_realloc(matroska->packets, (matroska->num_packets - 1) * | |
| 1611 | − sizeof(AVPacket *)); | |
| 1629 | + newpackets = av_realloc(matroska->packets, | |
| 1630 | + (matroska->num_packets - 1) * sizeof(AVPacket *)); | |
| 1631 | + if (newpackets) | |
| 1632 | + matroska->packets = newpackets; | |
| 1612 | 1633 | } else { |
| 1613 | 1634 | av_freep(&matroska->packets); |
| 1614 | 1635 | } |