diff options
| author | wm4 <nfxjfg@googlemail.com> | 2015-02-03 14:41:10 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2015-06-10 02:13:08 +0200 |
| commit | 64857ecd68b7aad7dc6cf4e9a26d46250315ebb0 (patch) | |
| tree | 3195c9799a77c53aeb0304c2791103984fc3ab9c | |
| parent | 904f75d3c46ba4359aecdf77a206a194882b9810 (diff) | |
| download | ffmpeg-64857ecd68b7aad7dc6cf4e9a26d46250315ebb0.tar.gz | |
avformat/tta: fix crash with corrupted files
av_add_index_entry() can fail, for example because the parameters are
invalid, or because memory allocation fails. Check this; it can actually
happen with corrupted files.
The second hunk is just for robustness. Just in case functions like
ff_reduce_index() remove entries. (Not sure if this can actually
happen.)
Fixes ticket #4294.
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 6a0cd529a35190d9374b0b26504e71857cd67b83)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavformat/tta.c | 11 |
1 files changed, 9 insertions, 2 deletions
diff --git a/libavformat/tta.c b/libavformat/tta.c index bbb6a2292c..9cfadb9356 100644 --- a/libavformat/tta.c +++ b/libavformat/tta.c @@ -122,8 +122,10 @@ static int tta_read_header(AVFormatContext *s) ffio_init_checksum(s->pb, tta_check_crc, UINT32_MAX); for (i = 0; i < c->totalframes; i++) { uint32_t size = avio_rl32(s->pb); - av_add_index_entry(st, framepos, i * c->frame_size, size, 0, - AVINDEX_KEYFRAME); + int r; + if ((r = av_add_index_entry(st, framepos, i * c->frame_size, size, 0, + AVINDEX_KEYFRAME)) < 0) + return r; framepos += size; } crc = ffio_get_checksum(s->pb) ^ UINT32_MAX; @@ -157,6 +159,11 @@ static int tta_read_packet(AVFormatContext *s, AVPacket *pkt) if (c->currentframe >= c->totalframes) return AVERROR_EOF; + if (st->nb_index_entries < c->totalframes) { + av_log(s, AV_LOG_ERROR, "Index entry disappeared\n"); + return AVERROR_INVALIDDATA; + } + size = st->index_entries[c->currentframe].size; ret = av_get_packet(s->pb, pkt, size); |