lavf/movenc: fix invalid free with timecode meta and tmcd data copy.

[ffmpeg] / libavformat / mpc8.c

diff --git a/libavformat/mpc8.c b/libavformat/mpc8.c
index c8eaddc7570bbcf40a9bcba88e7af0ec50ebee02..2951c27e783943767a46a37a0c0f8938199ce358 100644 (file)
--- a/libavformat/mpc8.c
+++ b/libavformat/mpc8.c
@@ -21,6 +21,7 @@
 
 #include "libavcodec/get_bits.h"
 #include "libavcodec/unary.h"
+#include "apetag.h"
 #include "avformat.h"
 #include "internal.h"
 #include "avio_internal.h"
@@ -51,6 +52,8 @@ typedef struct {
     int frame;
     int64_t header_pos;
     int64_t samples;
+
+    int64_t apetag_start;
 } MPCContext;
 
 static inline int64_t bs_get_v(uint8_t **bs)
@@ -199,7 +202,7 @@ static int mpc8_read_header(AVFormatContext *s)
     c->header_pos = avio_tell(pb);
     if(avio_rl32(pb) != TAG_MPCK){
         av_log(s, AV_LOG_ERROR, "Not a Musepack8 file\n");
-        return -1;
+        return AVERROR_INVALIDDATA;
     }
 
     while(!url_feof(pb)){
@@ -211,14 +214,14 @@ static int mpc8_read_header(AVFormatContext *s)
     }
     if(tag != TAG_STREAMHDR){
         av_log(s, AV_LOG_ERROR, "Stream header not found\n");
-        return -1;
+        return AVERROR_INVALIDDATA;
     }
     pos = avio_tell(pb);
     avio_skip(pb, 4); //CRC
     c->ver = avio_r8(pb);
     if(c->ver != 8){
         av_log(s, AV_LOG_ERROR, "Unknown stream version %d\n", c->ver);
-        return -1;
+        return AVERROR_PATCHWELCOME;
     }
     c->samples = ffio_read_varlen(pb);
     ffio_read_varlen(pb); //silence samples at the beginning
@@ -242,6 +245,12 @@ static int mpc8_read_header(AVFormatContext *s)
     if (size > 0)
         avio_skip(pb, size);
 
+    if (pb->seekable) {
+        int64_t pos = avio_tell(s->pb);
+        c->apetag_start = ff_ape_parse_tag(s);
+        avio_seek(s->pb, pos, SEEK_SET);
+    }
+
     return 0;
 }
 
@@ -253,6 +262,11 @@ static int mpc8_read_packet(AVFormatContext *s, AVPacket *pkt)
 
     while(!url_feof(s->pb)){
         pos = avio_tell(s->pb);
+
+        /* don't return bogus packets with the ape tag data */
+        if (c->apetag_start && pos >= c->apetag_start)
+            return AVERROR_EOF;
+
         mpc8_get_chunk_header(s->pb, &tag, &size);
         if (size < 0)
             return -1;