Merge commit '7295b7373862ee54903b33d6ef3335531dfa93ad'

[ffmpeg] / libavformat / mxfdec.c

diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c
index f8d0f9e0570bb99796d054d1222c85a86858c798..476d284c96718c9821098c03ff8b3c0f34cc2a19 100644 (file)
--- a/libavformat/mxfdec.c
+++ b/libavformat/mxfdec.c
@@ -500,7 +500,7 @@ static int mxf_read_primer_pack(void *arg, AVIOContext *pb, int tag, int size, U
         avpriv_request_sample(pb, "Primer pack item length %d", item_len);
         return AVERROR_PATCHWELCOME;
     }
-    if (item_num > 65536) {
+    if (item_num > 65536 || item_num < 0) {
         av_log(mxf->fc, AV_LOG_ERROR, "item_num %d is too large\n", item_num);
         return AVERROR_INVALIDDATA;
     }
@@ -899,6 +899,8 @@ static int mxf_read_index_entry_array(AVIOContext *pb, MXFIndexTableSegment *seg
     segment->nb_index_entries = avio_rb32(pb);
 
     length = avio_rb32(pb);
+    if(segment->nb_index_entries && length < 11)
+        return AVERROR_INVALIDDATA;
 
     if (!(segment->temporal_offset_entries=av_calloc(segment->nb_index_entries, sizeof(*segment->temporal_offset_entries))) ||
         !(segment->flag_entries          = av_calloc(segment->nb_index_entries, sizeof(*segment->flag_entries))) ||
@@ -909,6 +911,8 @@ static int mxf_read_index_entry_array(AVIOContext *pb, MXFIndexTableSegment *seg
     }
 
     for (i = 0; i < segment->nb_index_entries; i++) {
+        if(avio_feof(pb))
+            return AVERROR_INVALIDDATA;
         segment->temporal_offset_entries[i] = avio_r8(pb);
         avio_r8(pb);                                        /* KeyFrameOffset */
         segment->flag_entries[i] = avio_r8(pb);
@@ -3056,6 +3060,32 @@ static int mxf_set_audio_pts(MXFContext *mxf, AVCodecParameters *par,
     return 0;
 }
 
+static int mxf_set_pts(MXFContext *mxf, AVStream *st, AVPacket *pkt, int64_t next_ofs)
+{
+    AVCodecParameters *par = st->codecpar;
+    MXFTrack *track = st->priv_data;
+
+    if (par->codec_type == AVMEDIA_TYPE_VIDEO && next_ofs >= 0) {
+        /* mxf->current_edit_unit good - see if we have an
+         * index table to derive timestamps from */
+        MXFIndexTable *t = &mxf->index_tables[0];
+
+        if (mxf->nb_index_tables >= 1 && mxf->current_edit_unit < t->nb_ptses) {
+            pkt->dts = mxf->current_edit_unit + t->first_dts;
+            pkt->pts = t->ptses[mxf->current_edit_unit];
+        } else if (track && track->intra_only) {
+            /* intra-only -> PTS = EditUnit.
+             * let utils.c figure out DTS since it can be < PTS if low_delay = 0 (Sony IMX30) */
+            pkt->pts = mxf->current_edit_unit;
+        }
+    } else if (par->codec_type == AVMEDIA_TYPE_AUDIO) {
+        int ret = mxf_set_audio_pts(mxf, par, pkt);
+        if (ret < 0)
+            return ret;
+    }
+    return 0;
+}
+
 static int mxf_read_packet_old(AVFormatContext *s, AVPacket *pkt)
 {
     KLVPacket klv;
@@ -3079,8 +3109,6 @@ static int mxf_read_packet_old(AVFormatContext *s, AVPacket *pkt)
             int index = mxf_get_stream_index(s, &klv);
             int64_t next_ofs, next_klv;
             AVStream *st;
-            MXFTrack *track;
-            AVCodecParameters *par;
 
             if (index < 0) {
                 av_log(s, AV_LOG_ERROR,
@@ -3090,7 +3118,6 @@ static int mxf_read_packet_old(AVFormatContext *s, AVPacket *pkt)
             }
 
             st = s->streams[index];
-            track = st->priv_data;
 
             if (s->streams[index]->discard == AVDISCARD_ALL)
                 goto skip;
@@ -3125,26 +3152,9 @@ static int mxf_read_packet_old(AVFormatContext *s, AVPacket *pkt)
             pkt->stream_index = index;
             pkt->pos = klv.offset;
 
-            par = st->codecpar;
-
-            if (par->codec_type == AVMEDIA_TYPE_VIDEO && next_ofs >= 0) {
-                /* mxf->current_edit_unit good - see if we have an
-                 * index table to derive timestamps from */
-                MXFIndexTable *t = &mxf->index_tables[0];
-
-                if (mxf->nb_index_tables >= 1 && mxf->current_edit_unit < t->nb_ptses) {
-                    pkt->dts = mxf->current_edit_unit + t->first_dts;
-                    pkt->pts = t->ptses[mxf->current_edit_unit];
-                } else if (track && track->intra_only) {
-                    /* intra-only -> PTS = EditUnit.
-                     * let utils.c figure out DTS since it can be < PTS if low_delay = 0 (Sony IMX30) */
-                    pkt->pts = mxf->current_edit_unit;
-                }
-            } else if (par->codec_type == AVMEDIA_TYPE_AUDIO) {
-                ret = mxf_set_audio_pts(mxf, par, pkt);
-                if (ret < 0)
-                    return ret;
-            }
+            ret = mxf_set_pts(mxf, st, pkt, next_ofs);
+            if (ret < 0)
+                return ret;
 
             /* seek for truncated packets */
             avio_seek(s->pb, next_klv, SEEK_SET);
@@ -3207,15 +3217,9 @@ static int mxf_read_packet(AVFormatContext *s, AVPacket *pkt)
 
     pkt->stream_index = st->index;
 
-    if (st->codecpar->codec_type == AVMEDIA_TYPE_VIDEO && t->ptses &&
-        mxf->current_edit_unit >= 0 && mxf->current_edit_unit < t->nb_ptses) {
-        pkt->dts = mxf->current_edit_unit + t->first_dts;
-        pkt->pts = t->ptses[mxf->current_edit_unit];
-    } else if (st->codecpar->codec_type == AVMEDIA_TYPE_AUDIO) {
-        int ret = mxf_set_audio_pts(mxf, st->codecpar, pkt);
-        if (ret < 0)
-            return ret;
-    }
+    ret = mxf_set_pts(mxf, st, pkt, next_pos);
+    if (ret < 0)
+        return ret;
 
     mxf->current_edit_unit += edit_units;