avcodec/hapdec: Check section_size for non negativity in parse_section_header()

[ffmpeg] / libavcodec / hapdec.c

diff --git a/libavcodec/hapdec.c b/libavcodec/hapdec.c
index f4f6ef6f2b7f14b954bcc91b8999780b95a95af1..6adac21bbbd6a4f5d6005a9a86e217b517fef1ef 100644 (file)
--- a/libavcodec/hapdec.c
+++ b/libavcodec/hapdec.c
@@ -37,10 +37,10 @@
 #include "bytestream.h"
 #include "hap.h"
 #include "internal.h"
+#include "memory.h"
 #include "snappy.h"
 #include "texturedsp.h"
 #include "thread.h"
-#include "memory.h"
 
 /* The first three bytes are the size of the section past the header, or zero
  * if the length is stored in the next long word. The fourth byte in the first
@@ -61,7 +61,7 @@ static int parse_section_header(GetByteContext *gbc, int *section_size,
         *section_size = bytestream2_get_le32(gbc);
     }
 
-    if (*section_size > bytestream2_get_bytes_left(gbc))
+    if (*section_size > bytestream2_get_bytes_left(gbc) || *section_size < 0)
         return AVERROR_INVALIDDATA;
     else
         return 0;
@@ -162,10 +162,11 @@ static int hap_parse_frame_header(AVCodecContext *avctx)
     if (ret != 0)
         return ret;
 
-    if ((avctx->codec_tag == MKTAG('H','a','p','1') && (section_type & 0x0F) != HAP_FMT_RGBDXT1)
-        || (avctx->codec_tag == MKTAG('H','a','p','5') && (section_type & 0x0F) != HAP_FMT_RGBADXT5)
-        || (avctx->codec_tag == MKTAG('H','a','p','Y') && (section_type & 0x0F) != HAP_FMT_YCOCGDXT5)) {
-        av_log(avctx, AV_LOG_ERROR, "Invalid texture format %#04x.\n", section_type & 0x0F);
+    if ((avctx->codec_tag == MKTAG('H','a','p','1') && (section_type & 0x0F) != HAP_FMT_RGBDXT1) ||
+        (avctx->codec_tag == MKTAG('H','a','p','5') && (section_type & 0x0F) != HAP_FMT_RGBADXT5) ||
+        (avctx->codec_tag == MKTAG('H','a','p','Y') && (section_type & 0x0F) != HAP_FMT_YCOCGDXT5)) {
+        av_log(avctx, AV_LOG_ERROR,
+               "Invalid texture format %#04x.\n", section_type & 0x0F);
         return AVERROR_INVALIDDATA;
     }
 
@@ -251,6 +252,7 @@ static int decompress_chunks_thread(AVCodecContext *avctx, void *arg,
     if (chunk->compressor == HAP_COMP_SNAPPY) {
         int ret;
         int64_t uncompressed_size = ctx->tex_size;
+
         /* Uncompress the frame */
         ret = ff_snappy_uncompress(&gbc, dst, &uncompressed_size);
         if (ret < 0) {
@@ -432,8 +434,8 @@ AVCodec ff_hap_decoder = {
     .decode         = hap_decode,
     .close          = hap_close,
     .priv_data_size = sizeof(HapContext),
-    .capabilities   = CODEC_CAP_FRAME_THREADS | CODEC_CAP_SLICE_THREADS |
-                      CODEC_CAP_DR1,
+    .capabilities   = AV_CODEC_CAP_FRAME_THREADS | AV_CODEC_CAP_SLICE_THREADS |
+                      AV_CODEC_CAP_DR1,
     .caps_internal  = FF_CODEC_CAP_INIT_THREADSAFE |
                       FF_CODEC_CAP_INIT_CLEANUP,
 };