Inspired by work from: Michael Niedermayer <michaelni@gmx.at>.
Unified · Split
| @@ -27,6 +27,8 @@ · 26 unmodified lines | ||
| 27 | 27 | #include "avformat.h" |
| 28 | 28 | #include "adts.h" |
| 29 | 29 | |
| 30 | +#define ADTS_MAX_FRAME_BYTES ((1 << 13) - 1) | |
| 31 | + | |
| 30 | 32 | int ff_adts_decode_extradata(AVFormatContext *s, ADTSContext *adts, uint8_t *buf, int size) |
| 31 | 33 | { |
| 32 | 34 | GetBitContext gb; |
| @@ -93,6 +95,13 @@ int ff_adts_write_frame_header(ADTSContext *ctx, · 60 unmodified lines | ||
| 93 | 95 | { |
| 94 | 96 | PutBitContext pb; |
| 95 | 97 | |
| 98 | + unsigned full_frame_size = (unsigned)ADTS_HEADER_SIZE + size + pce_size; | |
| 99 | + if (full_frame_size > ADTS_MAX_FRAME_BYTES) { | |
| 100 | + av_log(NULL, AV_LOG_ERROR, "ADTS frame size too large: %u (max %d)\n", | |
| 101 | + full_frame_size, ADTS_MAX_FRAME_BYTES); | |
| 102 | + return AVERROR_INVALIDDATA; | |
| 103 | + } | |
| 104 | + | |
| 96 | 105 | init_put_bits(&pb, buf, ADTS_HEADER_SIZE); |
| 97 | 106 | |
| 98 | 107 | /* adts_fixed_header */ |
| @@ -110,7 +119,7 @@ int ff_adts_write_frame_header(ADTSContext *ctx, · 11 unmodified lines | ||
| 110 | 119 | /* adts_variable_header */ |
| 111 | 120 | put_bits(&pb, 1, 0); /* copyright_identification_bit */ |
| 112 | 121 | put_bits(&pb, 1, 0); /* copyright_identification_start */ |
| 113 | − put_bits(&pb, 13, ADTS_HEADER_SIZE + size + pce_size); /* aac_frame_length */ | |
| 122 | + put_bits(&pb, 13, full_frame_size); /* aac_frame_length */ | |
| 114 | 123 | put_bits(&pb, 11, 0x7ff); /* adts_buffer_fullness */ |
| 115 | 124 | put_bits(&pb, 2, 0); /* number_of_raw_data_blocks_in_frame */ |
| 116 | 125 | |
| @@ -128,7 +137,10 @@ static int adts_write_packet(AVFormatContext *s, AVPacket *pkt) · 11 unmodified lines | ||
| 128 | 137 | if (!pkt->size) |
| 129 | 138 | return 0; |
| 130 | 139 | if (adts->write_adts) { |
| 131 | − ff_adts_write_frame_header(adts, buf, pkt->size, adts->pce_size); | |
| 140 | + int err = ff_adts_write_frame_header(adts, buf, pkt->size, | |
| 141 | + adts->pce_size); | |
| 142 | + if (err < 0) | |
| 143 | + return err; | |
| 132 | 144 | avio_write(pb, buf, ADTS_HEADER_SIZE); |
| 133 | 145 | if (adts->pce_size) { |
| 134 | 146 | avio_write(pb, adts->pce_data, adts->pce_size); |
| @@ -971,7 +971,7 @@ static int mpegts_write_packet(AVFormatContext *s, AVPacket *pkt) · 970 unmodified lines | ||
| 971 | 971 | return -1; |
| 972 | 972 | if ((AV_RB16(pkt->data) & 0xfff0) != 0xfff0) { |
| 973 | 973 | ADTSContext *adts = ts_st->adts; |
| 974 | − int new_size; | |
| 974 | + int new_size, err; | |
| 975 | 975 | if (!adts) { |
| 976 | 976 | av_log(s, AV_LOG_ERROR, "aac bitstream not in adts format " |
| 977 | 977 | "and extradata missing\n"); |
| @@ -983,7 +983,12 @@ static int mpegts_write_packet(AVFormatContext *s, AVPacket *pkt) · 5 unmodified lines | ||
| 983 | 983 | data = av_malloc(new_size); |
| 984 | 984 | if (!data) |
| 985 | 985 | return AVERROR(ENOMEM); |
| 986 | − ff_adts_write_frame_header(adts, data, pkt->size, adts->pce_size); | |
| 986 | + err = ff_adts_write_frame_header(adts, data, pkt->size, | |
| 987 | + adts->pce_size); | |
| 988 | + if (err < 0) { | |
| 989 | + av_free(data); | |
| 990 | + return err; | |
| 991 | + } | |
| 987 | 992 | if (adts->pce_size) { |
| 988 | 993 | memcpy(data+ADTS_HEADER_SIZE, adts->pce_data, adts->pce_size); |
| 989 | 994 | adts->pce_size = 0; |