diff options
author | Michael Niedermayer <michaelni@gmx.at> | 2014-08-14 02:11:02 +0200 |
---|---|---|
committer | Michael Niedermayer <michaelni@gmx.at> | 2014-08-14 02:13:46 +0200 |
commit | 1d7544b752e73c4c554caca3dfc22ba23050f879 (patch) | |
tree | 4c35764ff335b24a5d060dedde3667bd35eeb0d4 /libavformat | |
parent | af5ec182252d869c62e327b3b2ffe3dc043fabbd (diff) | |
parent | e8049af1325dd59a51546c15b2e71a0f578e9d27 (diff) | |
download | ffmpeg-1d7544b752e73c4c554caca3dfc22ba23050f879.tar.gz |
Merge commit 'e8049af1325dd59a51546c15b2e71a0f578e9d27'
* commit 'e8049af1325dd59a51546c15b2e71a0f578e9d27':
mpegts: Do not try to write a PMT larger than SECTION_SIZE
Conflicts:
libavformat/mpegtsenc.c
See: 842b6c14bcfc1c5da1a2d288fd65386eb8c158ad
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavformat')
-rw-r--r-- | libavformat/mpegtsenc.c | 29 |
1 files changed, 23 insertions, 6 deletions
diff --git a/libavformat/mpegtsenc.c b/libavformat/mpegtsenc.c index e37f6d4d9b..c925afbe1a 100644 --- a/libavformat/mpegtsenc.c +++ b/libavformat/mpegtsenc.c @@ -233,7 +233,7 @@ static int mpegts_write_pmt(AVFormatContext *s, MpegTSService *service) { MpegTSWrite *ts = s->priv_data; uint8_t data[SECTION_LENGTH], *q, *desc_length_ptr, *program_info_length_ptr; - int val, stream_type, i; + int val, stream_type, i, err = 0; q = data; put16(&q, 0xe000 | service->pcr_pid); @@ -251,6 +251,11 @@ static int mpegts_write_pmt(AVFormatContext *s, MpegTSService *service) AVStream *st = s->streams[i]; MpegTSWriteStream *ts_st = st->priv_data; AVDictionaryEntry *lang = av_dict_get(st->metadata, "language", NULL, 0); + + if (q - data > SECTION_LENGTH - 32) { + err = 1; + break; + } switch (st->codec->codec_id) { case AV_CODEC_ID_MPEG1VIDEO: case AV_CODEC_ID_MPEG2VIDEO: @@ -297,9 +302,6 @@ static int mpegts_write_pmt(AVFormatContext *s, MpegTSService *service) break; } - if (q - data > sizeof(data) - 32) - return AVERROR(EINVAL); - *q++ = stream_type; put16(&q, 0xe000 | ts_st->pid); desc_length_ptr = q; @@ -331,7 +333,11 @@ static int mpegts_write_pmt(AVFormatContext *s, MpegTSService *service) len_ptr = q++; *len_ptr = 0; - for (p = lang->value; next && *len_ptr < 255 / 4 * 4 && q - data < sizeof(data) - 4; p = next + 1) { + for (p = lang->value; next && *len_ptr < 255 / 4 * 4; p = next + 1) { + if (q - data > SECTION_LENGTH - 4) { + err = 1; + break; + } next = strchr(p, ','); if (strlen(p) != 3 && (!next || next != p + 3)) continue; /* not a 3-letter code */ @@ -368,7 +374,11 @@ static int mpegts_write_pmt(AVFormatContext *s, MpegTSService *service) *q++ = 0x59; /* subtitling_descriptor */ len_ptr = q++; - while (strlen(language) >= 3 && (sizeof(data) - (q - data)) >= 8) { /* 8 bytes per DVB subtitle substream data */ + while (strlen(language) >= 3) { + if (sizeof(data) - (q - data) < 8) { /* 8 bytes per DVB subtitle substream data */ + err = 1; + break; + } *q++ = *language++; *q++ = *language++; *q++ = *language++; @@ -459,6 +469,13 @@ static int mpegts_write_pmt(AVFormatContext *s, MpegTSService *service) desc_length_ptr[0] = val >> 8; desc_length_ptr[1] = val; } + + if (err) + av_log(s, AV_LOG_ERROR, + "The PMT section cannot fit stream %d and all following streams.\n" + "Try reducing the number of languages in the audio streams " + "or the total number of streams.\n", i); + mpegts_write_section1(&service->pmt, PMT_TID, service->sid, ts->tables_version, 0, 0, data, q - data); return 0; |