aboutsummaryrefslogtreecommitdiffstats
path: root/libavformat/swfdec.c
diff options
context:
space:
mode:
authorJustin Ruggles <justin.ruggles@gmail.com>2012-12-10 12:44:09 -0500
committerJustin Ruggles <justin.ruggles@gmail.com>2012-12-11 09:36:26 -0500
commite70c5b034c4787377e82cab2d5565486baec0c2a (patch)
tree7a3d67b1f5dd4adc36bc874a1a6b331d9e5c033a /libavformat/swfdec.c
parent02823f6d7188260dabb10c64d6dd74331e7772e0 (diff)
downloadffmpeg-e70c5b034c4787377e82cab2d5565486baec0c2a.tar.gz
swfdec: do better validation of tag length
Avoids trying to read a packet with 0 or negative size. Avoids a potential infinite loop due to seeking backwards. Partially based on a patch by Michael Niedermayer.
Diffstat (limited to 'libavformat/swfdec.c')
-rw-r--r--libavformat/swfdec.c22
1 files changed, 19 insertions, 3 deletions
diff --git a/libavformat/swfdec.c b/libavformat/swfdec.c
index f105c141c6..d8a9852a89 100644
--- a/libavformat/swfdec.c
+++ b/libavformat/swfdec.c
@@ -100,6 +100,10 @@ static int swf_read_packet(AVFormatContext *s, AVPacket *pkt)
tag = get_swf_tag(pb, &len);
if (tag < 0)
return AVERROR(EIO);
+ if (len < 0) {
+ av_log(s, AV_LOG_ERROR, "invalid tag length: %d\n", len);
+ return AVERROR_INVALIDDATA;
+ }
if (tag == TAG_VIDEOSTREAM) {
int ch_id = avio_rl16(pb);
len -= 2;
@@ -161,7 +165,10 @@ static int swf_read_packet(AVFormatContext *s, AVPacket *pkt)
st = s->streams[i];
if (st->codec->codec_type == AVMEDIA_TYPE_VIDEO && st->id == ch_id) {
frame = avio_rl16(pb);
- if ((res = av_get_packet(pb, pkt, len-2)) < 0)
+ len -= 2;
+ if (len <= 0)
+ goto skip;
+ if ((res = av_get_packet(pb, pkt, len)) < 0)
return res;
pkt->pos = pos;
pkt->pts = frame;
@@ -175,9 +182,14 @@ static int swf_read_packet(AVFormatContext *s, AVPacket *pkt)
if (st->codec->codec_type == AVMEDIA_TYPE_AUDIO && st->id == -1) {
if (st->codec->codec_id == AV_CODEC_ID_MP3) {
avio_skip(pb, 4);
- if ((res = av_get_packet(pb, pkt, len-4)) < 0)
+ len -= 4;
+ if (len <= 0)
+ goto skip;
+ if ((res = av_get_packet(pb, pkt, len)) < 0)
return res;
} else { // ADPCM, PCM
+ if (len <= 0)
+ goto skip;
if ((res = av_get_packet(pb, pkt, len)) < 0)
return res;
}
@@ -203,7 +215,10 @@ static int swf_read_packet(AVFormatContext *s, AVPacket *pkt)
st = vst;
}
avio_rl16(pb); /* BITMAP_ID */
- if ((res = av_new_packet(pkt, len-2)) < 0)
+ len -= 2;
+ if (len < 4)
+ goto skip;
+ if ((res = av_new_packet(pkt, len)) < 0)
return res;
avio_read(pb, pkt->data, 4);
if (AV_RB32(pkt->data) == 0xffd8ffd9 ||
@@ -220,6 +235,7 @@ static int swf_read_packet(AVFormatContext *s, AVPacket *pkt)
return pkt->size;
}
skip:
+ len = FFMAX(0, len);
avio_skip(pb, len);
}
}