add out of bound stream index checks

[ffmpeg] / libavformat / ffm.c

diff --git a/libavformat/ffm.c b/libavformat/ffm.c
index b94452c18fc395433bc4d83ac99eedf194e4e6d3..872e6f0ba8dc3d07ee4b4536289799395ee97756 100644 (file)
--- a/libavformat/ffm.c
+++ b/libavformat/ffm.c
@@ -64,7 +64,7 @@ static void flush_packet(AVFormatContext *s)
 {
     FFMContext *ffm = s->priv_data;
     int fill_size, h;
-    ByteIOContext *pb = &s->pb;
+    ByteIOContext *pb = s->pb;
 
     fill_size = ffm->packet_end - ffm->packet_ptr;
     memset(ffm->packet_ptr, 0, fill_size);
@@ -128,7 +128,7 @@ static int ffm_write_header(AVFormatContext *s)
     FFMContext *ffm = s->priv_data;
     AVStream *st;
     FFMStream *fst;
-    ByteIOContext *pb = &s->pb;
+    ByteIOContext *pb = s->pb;
     AVCodecContext *codec;
     int bit_rate, i;
 
@@ -201,6 +201,7 @@ static int ffm_write_header(AVFormatContext *s)
             put_be32(pb, codec->nsse_weight);
             put_be32(pb, codec->frame_skip_cmp);
             put_be64(pb, av_dbl2int(codec->rc_buffer_aggressivity));
+            put_be32(pb, codec->codec_tag);
             break;
         case CODEC_TYPE_AUDIO:
             put_be32(pb, codec->sample_rate);
@@ -277,7 +278,7 @@ static int ffm_write_packet(AVFormatContext *s, AVPacket *pkt)
 
 static int ffm_write_trailer(AVFormatContext *s)
 {
-    ByteIOContext *pb = &s->pb;
+    ByteIOContext *pb = s->pb;
     FFMContext *ffm = s->priv_data;
 
     /* flush packets */
@@ -313,7 +314,7 @@ static int ffm_is_avail_data(AVFormatContext *s, int size)
         if (size <= len)
             return 1;
     }
-    pos = url_ftell(&s->pb);
+    pos = url_ftell(s->pb);
     if (pos == ffm->write_index) {
         /* exactly at the end of stream */
         return 0;
@@ -334,7 +335,7 @@ static int ffm_read_data(AVFormatContext *s,
                          uint8_t *buf, int size, int first)
 {
     FFMContext *ffm = s->priv_data;
-    ByteIOContext *pb = &s->pb;
+    ByteIOContext *pb = s->pb;
     int len, fill_size, size1, frame_offset;
 
     size1 = size;
@@ -392,7 +393,7 @@ static int ffm_read_data(AVFormatContext *s,
 static void adjust_write_index(AVFormatContext *s)
 {
     FFMContext *ffm = s->priv_data;
-    ByteIOContext *pb = &s->pb;
+    ByteIOContext *pb = s->pb;
     int64_t pts;
     //offset_t orig_write_index = ffm->write_index;
     offset_t pos_min, pos_max;
@@ -438,7 +439,7 @@ static void adjust_write_index(AVFormatContext *s)
         ffm->write_index += pos_max;
     }
 
-    //printf("Adjusted write index from %lld to %lld: pts=%0.6f\n", orig_write_index, ffm->write_index, pts / 1000000.);
+    //printf("Adjusted write index from %"PRId64" to %"PRId64": pts=%0.6f\n", orig_write_index, ffm->write_index, pts / 1000000.);
     //printf("pts range %0.6f - %0.6f\n", get_pts(s, 0) / 1000000. , get_pts(s, ffm->file_size - 2 * FFM_PACKET_SIZE) / 1000000. );
 
  end:
@@ -451,7 +452,7 @@ static int ffm_read_header(AVFormatContext *s, AVFormatParameters *ap)
     FFMContext *ffm = s->priv_data;
     AVStream *st;
     FFMStream *fst;
-    ByteIOContext *pb = &s->pb;
+    ByteIOContext *pb = s->pb;
     AVCodecContext *codec;
     int i, nb_streams;
     uint32_t tag;
@@ -469,7 +470,7 @@ static int ffm_read_header(AVFormatContext *s, AVFormatParameters *ap)
         ffm->file_size = url_fsize(pb);
         adjust_write_index(s);
     } else {
-        ffm->file_size = (uint64_t_C(1) << 63) - 1;
+        ffm->file_size = (UINT64_C(1) << 63) - 1;
     }
 
     nb_streams = get_be32(pb);
@@ -534,6 +535,7 @@ static int ffm_read_header(AVFormatContext *s, AVFormatParameters *ap)
             codec->nsse_weight = get_be32(pb);
             codec->frame_skip_cmp = get_be32(pb);
             codec->rc_buffer_aggressivity = av_int2dbl(get_be64(pb));
+            codec->codec_tag = get_be32(pb);
             break;
         case CODEC_TYPE_AUDIO:
             codec->sample_rate = get_be32(pb);
@@ -579,15 +581,15 @@ static int ffm_read_packet(AVFormatContext *s, AVPacket *pkt)
     switch(ffm->read_state) {
     case READ_HEADER:
         if (!ffm_is_avail_data(s, FRAME_HEADER_SIZE)) {
-            return -EAGAIN;
+            return AVERROR(EAGAIN);
         }
 #if 0
-        printf("pos=%08Lx spos=%Lx, write_index=%Lx size=%Lx\n",
-               url_ftell(&s->pb), s->pb.pos, ffm->write_index, ffm->file_size);
+        printf("pos=%08"PRIx64" spos=%"PRIx64", write_index=%"PRIx64" size=%"PRIx64"\n",
+               url_ftell(s->pb), s->pb.pos, ffm->write_index, ffm->file_size);
 #endif
         if (ffm_read_data(s, ffm->header, FRAME_HEADER_SIZE, 1) !=
             FRAME_HEADER_SIZE)
-            return -EAGAIN;
+            return AVERROR(EAGAIN);
 #if 0
         {
             int i;
@@ -599,16 +601,16 @@ static int ffm_read_packet(AVFormatContext *s, AVPacket *pkt)
         ffm->read_state = READ_DATA;
         /* fall thru */
     case READ_DATA:
-        size = (ffm->header[2] << 16) | (ffm->header[3] << 8) | ffm->header[4];
+        size = AV_RB24(ffm->header + 2);
         if (!ffm_is_avail_data(s, size)) {
-            return -EAGAIN;
+            return AVERROR(EAGAIN);
         }
 
-        duration = (ffm->header[5] << 16) | (ffm->header[6] << 8) | ffm->header[7];
+        duration = AV_RB24(ffm->header + 5);
 
         av_new_packet(pkt, size);
         pkt->stream_index = ffm->header[0];
-        pkt->pos = url_ftell(&s->pb);
+        pkt->pos = url_ftell(s->pb);
         if (ffm->header[1] & FLAG_KEY_FRAME)
             pkt->flags |= PKT_FLAG_KEY;
 
@@ -616,7 +618,7 @@ static int ffm_read_packet(AVFormatContext *s, AVPacket *pkt)
         if (ffm_read_data(s, pkt->data, size, 0) != size) {
             /* bad case: desynchronized packet. we cancel all the packet loading */
             av_free_packet(pkt);
-            return -EAGAIN;
+            return AVERROR(EAGAIN);
         }
         if (ffm->first_frame_in_packet)
         {
@@ -636,21 +638,21 @@ static int ffm_read_packet(AVFormatContext *s, AVPacket *pkt)
 static void ffm_seek1(AVFormatContext *s, offset_t pos1)
 {
     FFMContext *ffm = s->priv_data;
-    ByteIOContext *pb = &s->pb;
+    ByteIOContext *pb = s->pb;
     offset_t pos;
 
     pos = pos1 + ffm->write_index;
     if (pos >= ffm->file_size)
         pos -= (ffm->file_size - FFM_PACKET_SIZE);
 #ifdef DEBUG_SEEK
-    printf("seek to %Lx -> %Lx\n", pos1, pos);
+    printf("seek to %"PRIx64" -> %"PRIx64"\n", pos1, pos);
 #endif
     url_fseek(pb, pos, SEEK_SET);
 }
 
 static int64_t get_pts(AVFormatContext *s, offset_t pos)
 {
-    ByteIOContext *pb = &s->pb;
+    ByteIOContext *pb = s->pb;
     int64_t pts;
 
     ffm_seek1(s, pos);
@@ -663,7 +665,7 @@ static int64_t get_pts(AVFormatContext *s, offset_t pos)
 }
 
 /* seek to a given time in the file. The file read pointer is
-   positionned at or before pts. XXX: the following code is quite
+   positioned at or before pts. XXX: the following code is quite
    approximative */
 static int ffm_seek(AVFormatContext *s, int stream_index, int64_t wanted_pts, int flags)
 {
@@ -712,15 +714,10 @@ static int ffm_seek(AVFormatContext *s, int stream_index, int64_t wanted_pts, in
 offset_t ffm_read_write_index(int fd)
 {
     uint8_t buf[8];
-    offset_t pos;
-    int i;
 
     lseek(fd, 8, SEEK_SET);
     read(fd, buf, 8);
-    pos = 0;
-    for(i=0;i<8;i++)
-        pos |= (int64_t)buf[i] << (56 - i * 8);
-    return pos;
+    return AV_RB64(buf);
 }
 
 void ffm_write_write_index(int fd, offset_t pos)
@@ -756,7 +753,7 @@ static int ffm_read_close(AVFormatContext *s)
 
 static int ffm_probe(AVProbeData *p)
 {
-    if (p->buf_size >= 4 &&
+    if (
         p->buf[0] == 'F' && p->buf[1] == 'F' && p->buf[2] == 'M' &&
         p->buf[3] == '1')
         return AVPROBE_SCORE_MAX + 1;