Inspired by work from: Michael Niedermayer <michaelni@gmx.at>.
Unified · Split
| @@ -27,6 +27,8 @@ · 26 unmodified lines | |||
| 27 | #include "avformat.h" | 27 | #include "avformat.h" |
| 28 | #include "adts.h" | 28 | #include "adts.h" |
| 29 | 29 | ||
| 30 | #define ADTS_MAX_FRAME_BYTES ((1 << 13) - 1) | ||
| 31 | |||
| 30 | int ff_adts_decode_extradata(AVFormatContext *s, ADTSContext *adts, uint8_t *buf, int size) | 32 | int ff_adts_decode_extradata(AVFormatContext *s, ADTSContext *adts, uint8_t *buf, int size) |
| 31 | { | 33 | { |
| 32 | GetBitContext gb; | 34 | GetBitContext gb; |
| @@ -93,6 +95,13 @@ int ff_adts_write_frame_header(ADTSContext *ctx, · 60 unmodified lines | |||
| 93 | { | 95 | { |
| 94 | PutBitContext pb; | 96 | PutBitContext pb; |
| 95 | 97 | ||
| 98 | unsigned full_frame_size = (unsigned)ADTS_HEADER_SIZE + size + pce_size; | ||
| 99 | if (full_frame_size > ADTS_MAX_FRAME_BYTES) { | ||
| 100 | av_log(NULL, AV_LOG_ERROR, "ADTS frame size too large: %u (max %d)\n", | ||
| 101 | full_frame_size, ADTS_MAX_FRAME_BYTES); | ||
| 102 | return AVERROR_INVALIDDATA; | ||
| 103 | } | ||
| 104 | |||
| 96 | init_put_bits(&pb, buf, ADTS_HEADER_SIZE); | 105 | init_put_bits(&pb, buf, ADTS_HEADER_SIZE); |
| 97 | 106 | ||
| 98 | /* adts_fixed_header */ | 107 | /* adts_fixed_header */ |
| @@ -110,7 +119,7 @@ int ff_adts_write_frame_header(ADTSContext *ctx, · 11 unmodified lines | |||
| 110 | /* adts_variable_header */ | 119 | /* adts_variable_header */ |
| 111 | put_bits(&pb, 1, 0); /* copyright_identification_bit */ | 120 | put_bits(&pb, 1, 0); /* copyright_identification_bit */ |
| 112 | put_bits(&pb, 1, 0); /* copyright_identification_start */ | 121 | put_bits(&pb, 1, 0); /* copyright_identification_start */ |
| 113 | put_bits(&pb, 13, ADTS_HEADER_SIZE + size + pce_size); /* aac_frame_length */ | 122 | put_bits(&pb, 13, full_frame_size); /* aac_frame_length */ |
| 114 | put_bits(&pb, 11, 0x7ff); /* adts_buffer_fullness */ | 123 | put_bits(&pb, 11, 0x7ff); /* adts_buffer_fullness */ |
| 115 | put_bits(&pb, 2, 0); /* number_of_raw_data_blocks_in_frame */ | 124 | put_bits(&pb, 2, 0); /* number_of_raw_data_blocks_in_frame */ |
| 116 | 125 | ||
| @@ -128,7 +137,10 @@ static int adts_write_packet(AVFormatContext *s, AVPacket *pkt) · 11 unmodified lines | |||
| 128 | if (!pkt->size) | 137 | if (!pkt->size) |
| 129 | return 0; | 138 | return 0; |
| 130 | if (adts->write_adts) { | 139 | if (adts->write_adts) { |
| 131 | ff_adts_write_frame_header(adts, buf, pkt->size, adts->pce_size); | 140 | int err = ff_adts_write_frame_header(adts, buf, pkt->size, |
| 141 | adts->pce_size); | ||
| 142 | if (err < 0) | ||
| 143 | return err; | ||
| 132 | avio_write(pb, buf, ADTS_HEADER_SIZE); | 144 | avio_write(pb, buf, ADTS_HEADER_SIZE); |
| 133 | if (adts->pce_size) { | 145 | if (adts->pce_size) { |
| 134 | avio_write(pb, adts->pce_data, adts->pce_size); | 146 | avio_write(pb, adts->pce_data, adts->pce_size); |
| @@ -971,7 +971,7 @@ static int mpegts_write_packet(AVFormatContext *s, AVPacket *pkt) · 970 unmodified lines | |||
| 971 | return -1; | 971 | return -1; |
| 972 | if ((AV_RB16(pkt->data) & 0xfff0) != 0xfff0) { | 972 | if ((AV_RB16(pkt->data) & 0xfff0) != 0xfff0) { |
| 973 | ADTSContext *adts = ts_st->adts; | 973 | ADTSContext *adts = ts_st->adts; |
| 974 | int new_size; | 974 | int new_size, err; |
| 975 | if (!adts) { | 975 | if (!adts) { |
| 976 | av_log(s, AV_LOG_ERROR, "aac bitstream not in adts format " | 976 | av_log(s, AV_LOG_ERROR, "aac bitstream not in adts format " |
| 977 | "and extradata missing\n"); | 977 | "and extradata missing\n"); |
| @@ -983,7 +983,12 @@ static int mpegts_write_packet(AVFormatContext *s, AVPacket *pkt) · 5 unmodified lines | |||
| 983 | data = av_malloc(new_size); | 983 | data = av_malloc(new_size); |
| 984 | if (!data) | 984 | if (!data) |
| 985 | return AVERROR(ENOMEM); | 985 | return AVERROR(ENOMEM); |
| 986 | ff_adts_write_frame_header(adts, data, pkt->size, adts->pce_size); | 986 | err = ff_adts_write_frame_header(adts, data, pkt->size, |
| 987 | adts->pce_size); | ||
| 988 | if (err < 0) { | ||
| 989 | av_free(data); | ||
| 990 | return err; | ||
| 991 | } | ||
| 987 | if (adts->pce_size) { | 992 | if (adts->pce_size) { |
| 988 | memcpy(data+ADTS_HEADER_SIZE, adts->pce_data, adts->pce_size); | 993 | memcpy(data+ADTS_HEADER_SIZE, adts->pce_data, adts->pce_size); |
| 989 | adts->pce_size = 0; | 994 | adts->pce_size = 0; |