Whitespace of the patch cleaned up by Aurel Some of the issues have been reported by Steve Manzuik / Microsoft Vulnerability Research (MSVR) Signed-off-by: Michael Niedermayer <michaelni@gmx.at> (cherry picked from commit 956c901c68eff78288f40e3c8f41ee2fa081d4a8) Further suggestions from Kostya <kostya.shishkov@gmail.com> have been implemented by Reinhard Tartler <siretart@tauware.de>
Unified · Split
| @@ -801,11 +801,15 @@ static int ebml_parse_elem(MatroskaDemuxContext *matroska, · 800 unmodified lines | |||
| 801 | uint32_t id = syntax->id; | 801 | uint32_t id = syntax->id; |
| 802 | uint64_t length; | 802 | uint64_t length; |
| 803 | int res; | 803 | int res; |
| 804 | void *newelem; | ||
| 804 | 805 | ||
| 805 | data = (char *)data + syntax->data_offset; | 806 | data = (char *)data + syntax->data_offset; |
| 806 | if (syntax->list_elem_size) { | 807 | if (syntax->list_elem_size) { |
| 807 | EbmlList *list = data; | 808 | EbmlList *list = data; |
| 808 | list->elem = av_realloc(list->elem, (list->nb_elem+1)*syntax->list_elem_size); | 809 | newelem = av_realloc(list->elem, (list->nb_elem+1)*syntax->list_elem_size); |
| 810 | if (!newelem) | ||
| 811 | return AVERROR(ENOMEM); | ||
| 812 | list->elem = newelem; | ||
| 809 | data = (char*)list->elem + list->nb_elem*syntax->list_elem_size; | 813 | data = (char*)list->elem + list->nb_elem*syntax->list_elem_size; |
| 810 | memset(data, 0, syntax->list_elem_size); | 814 | memset(data, 0, syntax->list_elem_size); |
| 811 | list->nb_elem++; | 815 | list->nb_elem++; |
| @@ -935,6 +939,7 @@ static int matroska_decode_buffer(uint8_t** buf, int* buf_size, · 123 unmodified lines | |||
| 935 | uint8_t* data = *buf; | 939 | uint8_t* data = *buf; |
| 936 | int isize = *buf_size; | 940 | int isize = *buf_size; |
| 937 | uint8_t* pkt_data = NULL; | 941 | uint8_t* pkt_data = NULL; |
| 942 | uint8_t* newpktdata; | ||
| 938 | int pkt_size = isize; | 943 | int pkt_size = isize; |
| 939 | int result = 0; | 944 | int result = 0; |
| 940 | int olen; | 945 | int olen; |
| @@ -964,7 +969,12 @@ static int matroska_decode_buffer(uint8_t** buf, int* buf_size, · 23 unmodified lines | |||
| 964 | zstream.avail_in = isize; | 969 | zstream.avail_in = isize; |
| 965 | do { | 970 | do { |
| 966 | pkt_size *= 3; | 971 | pkt_size *= 3; |
| 967 | pkt_data = av_realloc(pkt_data, pkt_size); | 972 | newpktdata = av_realloc(pkt_data, pkt_size); |
| 973 | if (!newpktdata) { | ||
| 974 | inflateEnd(&zstream); | ||
| 975 | goto failed; | ||
| 976 | } | ||
| 977 | pkt_data = newpktdata; | ||
| 968 | zstream.avail_out = pkt_size - zstream.total_out; | 978 | zstream.avail_out = pkt_size - zstream.total_out; |
| 969 | zstream.next_out = pkt_data + zstream.total_out; | 979 | zstream.next_out = pkt_data + zstream.total_out; |
| 970 | result = inflate(&zstream, Z_NO_FLUSH); | 980 | result = inflate(&zstream, Z_NO_FLUSH); |
| @@ -985,7 +995,12 @@ static int matroska_decode_buffer(uint8_t** buf, int* buf_size, · 14 unmodified lines | |||
| 985 | bzstream.avail_in = isize; | 995 | bzstream.avail_in = isize; |
| 986 | do { | 996 | do { |
| 987 | pkt_size *= 3; | 997 | pkt_size *= 3; |
| 988 | pkt_data = av_realloc(pkt_data, pkt_size); | 998 | newpktdata = av_realloc(pkt_data, pkt_size); |
| 999 | if (!newpktdata) { | ||
| 1000 | BZ2_bzDecompressEnd(&bzstream); | ||
| 1001 | goto failed; | ||
| 1002 | } | ||
| 1003 | pkt_data = newpktdata; | ||
| 989 | bzstream.avail_out = pkt_size - bzstream.total_out_lo32; | 1004 | bzstream.avail_out = pkt_size - bzstream.total_out_lo32; |
| 990 | bzstream.next_out = pkt_data + bzstream.total_out_lo32; | 1005 | bzstream.next_out = pkt_data + bzstream.total_out_lo32; |
| 991 | result = BZ2_bzDecompress(&bzstream); | 1006 | result = BZ2_bzDecompress(&bzstream); |
| @@ -1040,13 +1055,17 @@ static void matroska_fix_ass_packet(MatroskaDemuxContext *matroska, · 48 unmodified lines | |||
| 1040 | } | 1055 | } |
| 1041 | } | 1056 | } |
| 1042 | 1057 | ||
| 1043 | static void matroska_merge_packets(AVPacket *out, AVPacket *in) | 1058 | static int matroska_merge_packets(AVPacket *out, AVPacket *in) |
| 1044 | { | 1059 | { |
| 1045 | out->data = av_realloc(out->data, out->size+in->size); | 1060 | void *newdata = av_realloc(out->data, out->size+in->size); |
| 1061 | if (!newdata) | ||
| 1062 | return AVERROR(ENOMEM); | ||
| 1063 | out->data = newdata; | ||
| 1046 | memcpy(out->data+out->size, in->data, in->size); | 1064 | memcpy(out->data+out->size, in->data, in->size); |
| 1047 | out->size += in->size; | 1065 | out->size += in->size; |
| 1048 | av_destruct_packet(in); | 1066 | av_destruct_packet(in); |
| 1049 | av_free(in); | 1067 | av_free(in); |
| 1068 | return 0; | ||
| 1050 | } | 1069 | } |
| 1051 | 1070 | ||
| 1052 | static void matroska_convert_tag(AVFormatContext *s, EbmlList *list, | 1071 | static void matroska_convert_tag(AVFormatContext *s, EbmlList *list, |
| @@ -1604,11 +1623,13 @@ static int matroska_deliver_packet(MatroskaDemuxContext *matroska, · 551 unmodified lines | |||
| 1604 | memcpy(pkt, matroska->packets[0], sizeof(AVPacket)); | 1623 | memcpy(pkt, matroska->packets[0], sizeof(AVPacket)); |
| 1605 | av_free(matroska->packets[0]); | 1624 | av_free(matroska->packets[0]); |
| 1606 | if (matroska->num_packets > 1) { | 1625 | if (matroska->num_packets > 1) { |
| 1626 | void *newpackets; | ||
| 1607 | memmove(&matroska->packets[0], &matroska->packets[1], | 1627 | memmove(&matroska->packets[0], &matroska->packets[1], |
| 1608 | (matroska->num_packets - 1) * sizeof(AVPacket *)); | 1628 | (matroska->num_packets - 1) * sizeof(AVPacket *)); |
| 1609 | matroska->packets = | 1629 | newpackets = av_realloc(matroska->packets, |
| 1610 | av_realloc(matroska->packets, (matroska->num_packets - 1) * | 1630 | (matroska->num_packets - 1) * sizeof(AVPacket *)); |
| 1611 | sizeof(AVPacket *)); | 1631 | if (newpackets) |
| 1632 | matroska->packets = newpackets; | ||
| 1612 | } else { | 1633 | } else { |
| 1613 | av_freep(&matroska->packets); | 1634 | av_freep(&matroska->packets); |
| 1614 | } | 1635 | } |