History

avformat/aiffdec: cleanup size handling for extreem cases

Michael Niedermayer committed 4 years ago

Commit c6f1e481 parent 55c605f1 file · +12 −17Browse files

Showing the changes to libavformat (1 of 1 file). Show all

Unified · Split

libavformat/aiffdec.c+12−17
@@ -54,9 +54,9 @@ static enum AVCodecID aiff_codec_get_id(int bps) · 53 unmodified lines
5454 }
5555
5656 /* returns the size of the found tag */
57−static int get_tag(AVIOContext *pb, uint32_t * tag)
57+static int64_t get_tag(AVIOContext *pb, uint32_t * tag)
5858 {
59− int size;
59+ int64_t size;
6060
6161 if (avio_feof(pb))
6262 return AVERROR(EIO);
@@ -64,16 +64,16 @@ static int get_tag(AVIOContext *pb, uint32_t * tag) · 1 unmodified line
6464 *tag = avio_rl32(pb);
6565 size = avio_rb32(pb);
6666
67− if (size < 0)
68− size = 0x7fffffff;
69−
7067 return size;
7168 }
7269
7370 /* Metadata string read */
74−static void get_meta(AVFormatContext *s, const char *key, int size)
71+static void get_meta(AVFormatContext *s, const char *key, int64_t size)
7572 {
76− uint8_t *str = av_malloc(size+1U);
73+ uint8_t *str = NULL;
74+
75+ if (size < SIZE_MAX)
76+ str = av_malloc(size+1);
7777
7878 if (str) {
7979 int res = avio_read(s->pb, str, size);
@@ -90,7 +90,7 @@ static void get_meta(AVFormatContext *s, const char *key, int size) · 10 unmodified lines
9090 }
9191
9292 /* Returns the number of sound data frames or negative on error */
93−static int get_aiff_header(AVFormatContext *s, int size,
93+static int get_aiff_header(AVFormatContext *s, int64_t size,
9494 unsigned version)
9595 {
9696 AVIOContext *pb = s->pb;
@@ -102,9 +102,6 @@ static int get_aiff_header(AVFormatContext *s, int size, · 5 unmodified lines
102102 unsigned int num_frames;
103103 int channels;
104104
105− if (size == INT_MAX)
106− return AVERROR_INVALIDDATA;
107−
108105 if (size & 1)
109106 size++;
110107 par->codec_type = AVMEDIA_TYPE_AUDIO;
@@ -216,7 +213,8 @@ static int aiff_probe(const AVProbeData *p) · 105 unmodified lines
216213 /* aiff input */
217214 static int aiff_read_header(AVFormatContext *s)
218215 {
219− int ret, size, filesize;
216+ int ret;
217+ int64_t filesize, size;
220218 int64_t offset = 0, position;
221219 uint32_t tag;
222220 unsigned version = AIFF_C_VERSION1;
@@ -227,7 +225,7 @@ static int aiff_read_header(AVFormatContext *s) · 4 unmodified lines
227225
228226 /* check FORM header */
229227 filesize = get_tag(pb, &tag);
230− if (filesize < 0 || tag != MKTAG('F', 'O', 'R', 'M'))
228+ if (filesize < 4 || tag != MKTAG('F', 'O', 'R', 'M'))
231229 return AVERROR_INVALIDDATA;
232230
233231 /* AIFF data type */
@@ -254,10 +252,7 @@ static int aiff_read_header(AVFormatContext *s) · 20 unmodified lines
254252 if (size < 0)
255253 return size;
256254
257− if (size >= 0x7fffffff - 8)
258− filesize = 0;
259− else
260− filesize -= size + 8;
255+ filesize -= size + 8;
261256
262257 switch (tag) {
263258 case MKTAG('C', 'O', 'M', 'M'): /* Common chunk */

Keyboard shortcuts

General

Show keyboard shortcuts
?
Focus the current search
/

Issues and pull requests

Open filters
f

Issues, pull requests and Inbox

Select next item
j↓
Select previous item
k↑
Open selected item
Enter
Dismiss filters or clear selection
Esc

Repository code

Go to file
t