avformat: add protocol_whitelist

[ffmpeg] / libavformat / asfdec_o.c

diff --git a/libavformat/asfdec_o.c b/libavformat/asfdec_o.c
index 02809bb4359a3ad4026b587fb896d78e14b2645d..2320c661cdc187b69ff75aa5b08529e035edcfa1 100644 (file)
--- a/libavformat/asfdec_o.c
+++ b/libavformat/asfdec_o.c
@@ -167,7 +167,7 @@ static void swap_guid(ff_asf_guid guid)
 
 static void align_position(AVIOContext *pb,  int64_t offset, uint64_t size)
 {
-    if (avio_tell(pb) != offset + size)
+    if (size < INT64_MAX - offset && avio_tell(pb) != offset + size)
         avio_seek(pb, offset + size, SEEK_SET);
 }
 
@@ -190,8 +190,13 @@ static int asf_read_unknown(AVFormatContext *s, const GUIDParseTable *g)
         if ((ret = detect_unknown_subobject(s, asf->unknown_offset,
                                             asf->unknown_size)) < 0)
             return ret;
-    } else
+    } else {
+        if (size < 24) {
+            av_log(s, AV_LOG_ERROR, "Too small size %"PRIu64" (< 24).\n", size);
+            return AVERROR_INVALIDDATA;
+        }
         avio_skip(pb, size - 24);
+    }
 
     return 0;
 }
@@ -266,7 +271,7 @@ static int asf_read_metadata(AVFormatContext *s, const char *title, uint16_t len
     return 0;
 }
 
-static int asf_read_value(AVFormatContext *s, const uint8_t *name, uint16_t name_len,
+static int asf_read_value(AVFormatContext *s, const uint8_t *name,
                           uint16_t val_len, int type, AVDictionary **met)
 {
     int ret;
@@ -331,7 +336,7 @@ static int asf_read_generic_value(AVIOContext *pb, int type, uint64_t *value)
 }
 
 static int asf_set_metadata(AVFormatContext *s, const uint8_t *name,
-                            uint16_t name_len, int type, AVDictionary **met)
+                            int type, AVDictionary **met)
 {
     AVIOContext *pb = s->pb;
     uint64_t value;
@@ -470,7 +475,7 @@ static int process_metadata(AVFormatContext *s, const uint8_t *name, uint16_t na
     if (val_len) {
         switch (type) {
         case ASF_UNICODE:
-            asf_read_value(s, name, name_len, val_len, type, met);
+            asf_read_value(s, name, val_len, type, met);
             break;
         case ASF_BYTE_ARRAY:
             if (!strcmp(name, "WM/Picture")) // handle cover art
@@ -478,13 +483,13 @@ static int process_metadata(AVFormatContext *s, const uint8_t *name, uint16_t na
             else if (!strcmp(name, "ID3")) // handle ID3 tag
                 get_id3_tag(s, val_len);
             else
-                asf_read_value(s, name, name_len, val_len, type, met);
+                asf_read_value(s, name, val_len, type, met);
             break;
         case ASF_GUID:
             ff_get_guid(s->pb, &guid);
             break;
         default:
-            if ((ret = asf_set_metadata(s, name, name_len, type, met)) < 0)
+            if ((ret = asf_set_metadata(s, name, type, met)) < 0)
                 return ret;
             break;
         }
@@ -970,7 +975,7 @@ static int asf_read_simple_index(AVFormatContext *s, const GUIDParseTable *g)
     uint64_t interval; // index entry time interval in 100 ns units, usually it's 1s
     uint32_t pkt_num, nb_entries;
     int32_t prev_pkt_num = -1;
-    int i;
+    int i, ret;
     uint64_t size = avio_rl64(pb);
 
     // simple index objects should be ordered by stream number, this loop tries to find
@@ -992,7 +997,11 @@ static int asf_read_simple_index(AVFormatContext *s, const GUIDParseTable *g)
     nb_entries = avio_rl32(pb);
     for (i = 0; i < nb_entries; i++) {
         pkt_num = avio_rl32(pb);
-        avio_skip(pb, 2);
+        ret = avio_skip(pb, 2);
+        if (ret < 0) {
+            av_log(s, AV_LOG_ERROR, "Skipping failed in asf_read_simple_index.\n");
+            return ret;
+        }
         if (prev_pkt_num != pkt_num) {
             av_add_index_entry(st, asf->first_packet_offset + asf->packet_size *
                                pkt_num, av_rescale(interval, i, 10000),
@@ -1208,8 +1217,7 @@ static int asf_read_multiple_payload(AVFormatContext *s, AVPacket *pkt,
     return 0;
 }
 
-static int asf_read_single_payload(AVFormatContext *s, AVPacket *pkt,
-                               ASFPacket *asf_pkt)
+static int asf_read_single_payload(AVFormatContext *s, ASFPacket *asf_pkt)
 {
     ASFContext *asf = s->priv_data;
     AVIOContext *pb = s->pb;
@@ -1283,6 +1291,10 @@ static int asf_read_payload(AVFormatContext *s, AVPacket *pkt)
         }
         if (!asf_pkt) {
             if (asf->packet_offset + asf->packet_size <= asf->data_offset + asf->data_size) {
+                if (!asf->packet_size) {
+                    av_log(s, AV_LOG_ERROR, "Invalid packet size 0.\n");
+                    return AVERROR_INVALIDDATA;
+                }
                 avio_seek(pb, asf->packet_offset + asf->packet_size, SEEK_SET);
                 av_log(s, AV_LOG_WARNING, "Skipping the stream with the invalid stream index %d.\n",
                        asf->stream_index);
@@ -1315,7 +1327,7 @@ static int asf_read_payload(AVFormatContext *s, AVPacket *pkt)
             if ((ret = asf_read_subpayload(s, pkt, 1)) < 0)
                 return ret;
         } else {
-            if ((ret = asf_read_single_payload(s, pkt, asf_pkt)) < 0)
+            if ((ret = asf_read_single_payload(s, asf_pkt)) < 0)
                 return ret;
         }
     } else {
@@ -1426,6 +1438,8 @@ static int asf_read_packet(AVFormatContext *s, AVPacket *pkt)
     while (!pb->eof_reached) {
         if (asf->state == PARSE_PACKET_HEADER) {
             asf_read_packet_header(s);
+            if (pb->eof_reached)
+                break;
             if (!asf->nb_mult_left)
                 asf->state = READ_SINGLE;
             else