Unified · Split
| @@ -571,29 +571,30 @@ buf_alloc_fail: · 570 unmodified lines | |||
| 571 | 571 | ||
| 572 | static int alac_set_info(ALACContext *alac) | 572 | static int alac_set_info(ALACContext *alac) |
| 573 | { | 573 | { |
| 574 | const unsigned char *ptr = alac->avctx->extradata; | 574 | GetByteContext gb; |
| 575 | 575 | ||
| 576 | ptr += 4; /* size */ | 576 | bytestream2_init(&gb, alac->avctx->extradata, |
| 577 | ptr += 4; /* alac */ | 577 | alac->avctx->extradata_size); |
| 578 | ptr += 4; /* version */ | ||
| 579 | 578 | ||
| 580 | if(AV_RB32(ptr) >= UINT_MAX/4){ | 579 | bytestream2_skipu(&gb, 12); // size:4, alac:4, version:4 |
| 581 | av_log(alac->avctx, AV_LOG_ERROR, "setinfo_max_samples_per_frame too large\n"); | ||
| 582 | return -1; | ||
| 583 | } | ||
| 584 | 580 | ||
| 585 | /* buffer size / 2 ? */ | 581 | /* buffer size / 2 ? */ |
| 586 | alac->setinfo_max_samples_per_frame = bytestream_get_be32(&ptr); | 582 | alac->setinfo_max_samples_per_frame = bytestream2_get_be32u(&gb); |
| 587 | ptr++; /* compatible version */ | 583 | if (alac->setinfo_max_samples_per_frame >= UINT_MAX/4){ |
| 588 | alac->setinfo_sample_size = *ptr++; | 584 | av_log(alac->avctx, AV_LOG_ERROR, |
| 589 | alac->setinfo_rice_historymult = *ptr++; | 585 | "setinfo_max_samples_per_frame too large\n"); |
| 590 | alac->setinfo_rice_initialhistory = *ptr++; | 586 | return AVERROR_INVALIDDATA; |
| 591 | alac->setinfo_rice_kmodifier = *ptr++; | 587 | } |
| 592 | alac->numchannels = *ptr++; | 588 | bytestream2_skipu(&gb, 1); // compatible version |
| 593 | bytestream_get_be16(&ptr); /* maxRun */ | 589 | alac->setinfo_sample_size = bytestream2_get_byteu(&gb); |
| 594 | bytestream_get_be32(&ptr); /* max coded frame size */ | 590 | alac->setinfo_rice_historymult = bytestream2_get_byteu(&gb); |
| 595 | bytestream_get_be32(&ptr); /* average bitrate */ | 591 | alac->setinfo_rice_initialhistory = bytestream2_get_byteu(&gb); |
| 596 | bytestream_get_be32(&ptr); /* samplerate */ | 592 | alac->setinfo_rice_kmodifier = bytestream2_get_byteu(&gb); |
| 593 | alac->numchannels = bytestream2_get_byteu(&gb); | ||
| 594 | bytestream2_get_be16u(&gb); // maxRun | ||
| 595 | bytestream2_get_be32u(&gb); // max coded frame size | ||
| 596 | bytestream2_get_be32u(&gb); // average bitrate | ||
| 597 | bytestream2_get_be32u(&gb); // samplerate | ||
| 597 | 598 | ||
| 598 | return 0; | 599 | return 0; |
| 599 | } | 600 | } |