rtpproto: Check the size before reading buf[1]

[ffmpeg] / libavformat / idcin.c

diff --git a/libavformat/idcin.c b/libavformat/idcin.c
index 122fd8ebe4a0023f1579f9c9c635a4dfde37019e..2536e8bd62c281a6b1cd43d9979ea84e30ce3a8b 100644 (file)
--- a/libavformat/idcin.c
+++ b/libavformat/idcin.c
@@ -68,7 +68,7 @@
  *       transmitting them to the video decoder
  */
 
-#include "libavutil/audioconvert.h"
+#include "libavutil/channel_layout.h"
 #include "libavutil/imgutils.h"
 #include "libavutil/intreadwrite.h"
 #include "avformat.h"
@@ -88,6 +88,7 @@ typedef struct IdcinDemuxContext {
     int current_audio_chunk;
     int next_chunk_is_video;
     int audio_present;
+    int64_t first_pkt_pos;
 } IdcinDemuxContext;
 
 static int idcin_probe(AVProbeData *p)
@@ -135,8 +136,8 @@ static int idcin_probe(AVProbeData *p)
     if (number > 2)
         return 0;
 
-    /* return half certainly since this check is a bit sketchy */
-    return AVPROBE_SCORE_MAX / 2;
+    /* return half certainty since this check is a bit sketchy */
+    return AVPROBE_SCORE_EXTENSION;
 }
 
 static int idcin_read_header(AVFormatContext *s)
@@ -146,6 +147,7 @@ static int idcin_read_header(AVFormatContext *s)
     AVStream *st;
     unsigned int width, height;
     unsigned int sample_rate, bytes_per_sample, channels;
+    int ret;
 
     /* get the 5 header parameters */
     width = avio_rl32(pb);
@@ -154,6 +156,11 @@ static int idcin_read_header(AVFormatContext *s)
     bytes_per_sample = avio_rl32(pb);
     channels = avio_rl32(pb);
 
+    if (s->pb->eof_reached) {
+        av_log(s, AV_LOG_ERROR, "incomplete header\n");
+        return s->pb->error ? s->pb->error : AVERROR_EOF;
+    }
+
     if (av_image_check_size(width, height, 0, s) < 0)
         return AVERROR_INVALIDDATA;
     if (sample_rate > 0) {
@@ -191,9 +198,13 @@ static int idcin_read_header(AVFormatContext *s)
     /* load up the Huffman tables into extradata */
     st->codec->extradata_size = HUFFMAN_TABLE_SIZE;
     st->codec->extradata = av_malloc(HUFFMAN_TABLE_SIZE);
-    if (avio_read(pb, st->codec->extradata, HUFFMAN_TABLE_SIZE) !=
-        HUFFMAN_TABLE_SIZE)
+    ret = avio_read(pb, st->codec->extradata, HUFFMAN_TABLE_SIZE);
+    if (ret < 0) {
+        return ret;
+    } else if (ret != HUFFMAN_TABLE_SIZE) {
+        av_log(s, AV_LOG_ERROR, "incomplete header\n");
         return AVERROR(EIO);
+    }
 
     if (idcin->audio_present) {
         idcin->audio_present = 1;
@@ -230,6 +241,7 @@ static int idcin_read_header(AVFormatContext *s)
     }
 
     idcin->next_chunk_is_video = 1;
+    idcin->first_pkt_pos = avio_tell(s->pb);
 
     return 0;
 }
@@ -249,7 +261,7 @@ static int idcin_read_packet(AVFormatContext *s,
     uint32_t palette[256];
 
     if (s->pb->eof_reached)
-        return AVERROR(EIO);
+        return s->pb->error ? s->pb->error : AVERROR_EOF;
 
     if (idcin->next_chunk_is_video) {
         command = avio_rl32(pb);
@@ -257,8 +269,13 @@ static int idcin_read_packet(AVFormatContext *s,
             return AVERROR(EIO);
         } else if (command == 1) {
             /* trigger a palette change */
-            if (avio_read(pb, palette_buffer, 768) != 768)
+            ret = avio_read(pb, palette_buffer, 768);
+            if (ret < 0) {
+                return ret;
+            } else if (ret != 768) {
+                av_log(s, AV_LOG_ERROR, "incomplete packet\n");
                 return AVERROR(EIO);
+            }
             /* scale the palette as necessary */
             palette_scale = 2;
             for (i = 0; i < 768; i++)
@@ -275,20 +292,35 @@ static int idcin_read_packet(AVFormatContext *s,
             }
         }
 
+        if (s->pb->eof_reached) {
+            av_log(s, AV_LOG_ERROR, "incomplete packet\n");
+            return s->pb->error ? s->pb->error : AVERROR_EOF;
+        }
         chunk_size = avio_rl32(pb);
+        if (chunk_size < 4 || chunk_size > INT_MAX - 4) {
+            av_log(s, AV_LOG_ERROR, "invalid chunk size: %u\n", chunk_size);
+            return AVERROR_INVALIDDATA;
+        }
         /* skip the number of decoded bytes (always equal to width * height) */
         avio_skip(pb, 4);
         chunk_size -= 4;
         ret= av_get_packet(pb, pkt, chunk_size);
         if (ret < 0)
             return ret;
+        else if (ret != chunk_size) {
+            av_log(s, AV_LOG_ERROR, "incomplete packet\n");
+            av_free_packet(pkt);
+            return AVERROR(EIO);
+        }
         if (command == 1) {
             uint8_t *pal;
 
             pal = av_packet_new_side_data(pkt, AV_PKT_DATA_PALETTE,
                                           AVPALETTE_SIZE);
-            if (ret < 0)
+            if (ret < 0) {
+                av_free_packet(pkt);
                 return ret;
+            }
             memcpy(pal, palette, AVPALETTE_SIZE);
             pkt->flags |= AV_PKT_FLAG_KEY;
         }
@@ -312,7 +344,24 @@ static int idcin_read_packet(AVFormatContext *s,
     if (idcin->audio_present)
         idcin->next_chunk_is_video ^= 1;
 
-    return ret;
+    return 0;
+}
+
+static int idcin_read_seek(AVFormatContext *s, int stream_index,
+                           int64_t timestamp, int flags)
+{
+    IdcinDemuxContext *idcin = s->priv_data;
+
+    if (idcin->first_pkt_pos > 0) {
+        int ret = avio_seek(s->pb, idcin->first_pkt_pos, SEEK_SET);
+        if (ret < 0)
+            return ret;
+        ff_update_cur_dts(s, s->streams[idcin->video_stream_index], 0);
+        idcin->next_chunk_is_video = 1;
+        idcin->current_audio_chunk = 0;
+        return 0;
+    }
+    return -1;
 }
 
 AVInputFormat ff_idcin_demuxer = {
@@ -322,4 +371,6 @@ AVInputFormat ff_idcin_demuxer = {
     .read_probe     = idcin_probe,
     .read_header    = idcin_read_header,
     .read_packet    = idcin_read_packet,
+    .read_seek      = idcin_read_seek,
+    .flags          = AVFMT_NO_BYTE_SEEK,
 };