mov: validate number of DataReferenceBox entries against box size

[ffmpeg] / libavformat / cdg.c

diff --git a/libavformat/cdg.c b/libavformat/cdg.c
index b60ea3710a4d525be05323992a6bd376051ab4f9..974880a63039d36352edcc33ca220a2dc217b6ee 100644 (file)
--- a/libavformat/cdg.c
+++ b/libavformat/cdg.c
@@ -20,10 +20,13 @@
  */
 
 #include "avformat.h"
+#include "internal.h"
 
 #define CDG_PACKET_SIZE    24
+#define CDG_COMMAND        0x09
+#define CDG_MASK           0x3F
 
-static int read_header(AVFormatContext *s, AVFormatParameters *ap)
+static int read_header(AVFormatContext *s)
 {
     AVStream *vst;
     int ret;
@@ -33,10 +36,10 @@ static int read_header(AVFormatContext *s, AVFormatParameters *ap)
         return AVERROR(ENOMEM);
 
     vst->codec->codec_type = AVMEDIA_TYPE_VIDEO;
-    vst->codec->codec_id   = CODEC_ID_CDGRAPHICS;
+    vst->codec->codec_id   = AV_CODEC_ID_CDGRAPHICS;
 
     /// 75 sectors/sec * 4 packets/sector = 300 packets/sec
-    av_set_pts_info(vst, 32, 1, 300);
+    avpriv_set_pts_info(vst, 32, 1, 300);
 
     ret = avio_size(s->pb);
     if (ret > 0)
@@ -49,7 +52,12 @@ static int read_packet(AVFormatContext *s, AVPacket *pkt)
 {
     int ret;
 
-    ret = av_get_packet(s->pb, pkt, CDG_PACKET_SIZE);
+    while (1) {
+        ret = av_get_packet(s->pb, pkt, CDG_PACKET_SIZE);
+        if (ret < 1 || (pkt->data[0] & CDG_MASK) == CDG_COMMAND)
+            break;
+        av_free_packet(pkt);
+    }
 
     pkt->stream_index = 0;
     return ret;
@@ -57,8 +65,8 @@ static int read_packet(AVFormatContext *s, AVPacket *pkt)
 
 AVInputFormat ff_cdg_demuxer = {
     .name           = "cdg",
-    .long_name      = NULL_IF_CONFIG_SMALL("CD Graphics Format"),
+    .long_name      = NULL_IF_CONFIG_SMALL("CD Graphics"),
     .read_header    = read_header,
     .read_packet    = read_packet,
-    .extensions = "cdg"
+    .extensions     = "cdg",
 };