static int rm_read_extradata(AVIOContext *pb, AVCodecContext *avctx, unsigned size)
{
- if (size >= 1<<24)
+ if (size >= 1<<24) {
+ av_log(avctx, AV_LOG_ERROR, "extradata size %u too large\n", size);
return -1;
+ }
if (ff_get_extradata(avctx, pb, size) < 0)
return AVERROR(ENOMEM);
return 0;
return 0;
}
-int
-ff_rm_read_mdpr_codecdata (AVFormatContext *s, AVIOContext *pb,
- AVStream *st, RMStream *rst, int codec_data_size, const uint8_t *mime)
+int ff_rm_read_mdpr_codecdata(AVFormatContext *s, AVIOContext *pb,
+ AVStream *st, RMStream *rst,
+ unsigned int codec_data_size, const uint8_t *mime)
{
unsigned int v;
int size;
int64_t codec_pos;
int ret;
+ if (codec_data_size > INT_MAX)
+ return AVERROR_INVALIDDATA;
+
avpriv_set_pts_info(st, 64, 1, 1000);
codec_pos = avio_tell(pb);
v = avio_rb32(pb);
skip:
/* skip codec info */
size = avio_tell(pb) - codec_pos;
- avio_skip(pb, codec_data_size - size);
+ if (codec_data_size >= size) {
+ avio_skip(pb, codec_data_size - size);
+ } else {
+ av_log(s, AV_LOG_WARNING, "codec_data_size %u < size %d\n", codec_data_size, size);
+ }
return 0;
}
/* multiple of 20 bytes for ra144 (ugly) */
#define RAW_PACKET_SIZE 1000
-static int sync(AVFormatContext *s, int64_t *timestamp, int *flags, int *stream_index, int64_t *pos){
+static int rm_sync(AVFormatContext *s, int64_t *timestamp, int *flags, int *stream_index, int64_t *pos){
RMDemuxContext *rm = s->priv_data;
AVIOContext *pb = s->pb;
AVStream *st;
flags = (seq++ == 1) ? 2 : 0;
pos = avio_tell(s->pb);
} else {
- len=sync(s, ×tamp, &flags, &i, &pos);
+ len = rm_sync(s, ×tamp, &flags, &i, &pos);
if (len > 0)
st = s->streams[i];
}
int seq=1;
AVStream *st;
- len=sync(s, &dts, &flags, &stream_index2, &pos);
+ len = rm_sync(s, &dts, &flags, &stream_index2, &pos);
if(len<0)
return AV_NOPTS_VALUE;