avformat/rtpdec: use av_packet_alloc() to allocate packets

[ffmpeg] / libavformat / moflex.c

diff --git a/libavformat/moflex.c b/libavformat/moflex.c
index 747e32f079c84c584b7caf2d489379a53d71212c..41335ada78986dc016944c50af432a33979ff3a1 100644 (file)
--- a/libavformat/moflex.c
+++ b/libavformat/moflex.c
@@ -1,5 +1,7 @@
 /*
  * MOFLEX demuxer
+ * Copyright (c) 2015-2016 Florian Nouwt
+ * Copyright (c) 2017 Adib Surani
  * Copyright (c) 2020 Paul B Mahol
  *
  * This file is part of FFmpeg.
@@ -62,6 +64,8 @@ static int pop_int(BitReader *br, AVIOContext *pb, int n)
 
         if (ret < 0)
             return ret;
+        if (ret > INT_MAX - value - value)
+            return AVERROR_INVALIDDATA;
         value = 2 * value + ret;
     }
 
@@ -314,6 +318,8 @@ static int moflex_read_packet(AVFormatContext *s, AVPacket *pkt)
             }
 
             pkt_size = pop_int(br, pb, 13) + 1;
+            if (pkt_size > m->size)
+                return AVERROR_INVALIDDATA;
             packet   = s->streams[stream_index]->priv_data;
             if (!packet) {
                 avio_skip(pb, pkt_size);
@@ -327,20 +333,39 @@ static int moflex_read_packet(AVFormatContext *s, AVPacket *pkt)
                 av_packet_move_ref(pkt, packet);
                 pkt->pos = m->pos;
                 pkt->stream_index = stream_index;
-                pkt->flags |= AV_PKT_FLAG_KEY;
+                if (s->streams[stream_index]->codecpar->codec_type == AVMEDIA_TYPE_VIDEO) {
+                    pkt->duration = 1;
+                    if (pkt->data[0] & 0x80)
+                        pkt->flags |= AV_PKT_FLAG_KEY;
+                } else {
+                    pkt->flags |= AV_PKT_FLAG_KEY;
+                }
                 return ret;
             }
         }
 
         m->in_block = 0;
 
-        if (m->flags % 2 == 0)
+        if (m->flags % 2 == 0) {
+            if (m->size <= 0)
+                return AVERROR_INVALIDDATA;
             avio_seek(pb, m->pos + m->size, SEEK_SET);
+        }
     }
 
     return AVERROR_EOF;
 }
 
+static int moflex_read_seek(AVFormatContext *s, int stream_index,
+                            int64_t pts, int flags)
+{
+    MOFLEXDemuxContext *m = s->priv_data;
+
+    m->in_block = 0;
+
+    return -1;
+}
+
 static int moflex_read_close(AVFormatContext *s)
 {
     for (int i = 0; i < s->nb_streams; i++) {
@@ -360,6 +385,7 @@ AVInputFormat ff_moflex_demuxer = {
     .read_probe     = moflex_probe,
     .read_header    = moflex_read_header,
     .read_packet    = moflex_read_packet,
+    .read_seek      = moflex_read_seek,
     .read_close     = moflex_read_close,
     .extensions     = "moflex",
     .flags          = AVFMT_GENERIC_INDEX,