return AVPROBE_SCORE_MAX;
}
+static int film_read_close(AVFormatContext *s)
+{
+ FilmDemuxContext *film = s->priv_data;
+
+ av_freep(&film->sample_table);
+ av_freep(&film->stereo_buffer);
+
+ return 0;
+}
+
static int film_read_header(AVFormatContext *s)
{
FilmDemuxContext *film = s->priv_data;
AVIOContext *pb = s->pb;
AVStream *st;
unsigned char scratch[256];
- int i;
+ int i, ret;
unsigned int data_offset;
unsigned int audio_frame_counter;
return AVERROR(EIO);
film->audio_samplerate = AV_RB16(&scratch[24]);
film->audio_channels = scratch[21];
+ if (!film->audio_channels || film->audio_channels > 2) {
+ av_log(s, AV_LOG_ERROR,
+ "Invalid number of channels: %d\n", film->audio_channels);
+ return AVERROR_INVALIDDATA;
+ }
film->audio_bits = scratch[22];
if (scratch[23] == 2)
film->audio_type = AV_CODEC_ID_ADPCM_ADX;
for (i = 0; i < film->sample_count; i++) {
/* load the next sample record and transfer it to an internal struct */
if (avio_read(pb, scratch, 16) != 16) {
- av_free(film->sample_table);
- return AVERROR(EIO);
+ ret = AVERROR(EIO);
+ goto fail;
}
film->sample_table[i].sample_offset =
data_offset + AV_RB32(&scratch[0]);
film->sample_table[i].sample_size = AV_RB32(&scratch[4]);
+ if (film->sample_table[i].sample_size > INT_MAX / 4) {
+ ret = AVERROR_INVALIDDATA;
+ goto fail;
+ }
if (AV_RB32(&scratch[8]) == 0xFFFFFFFF) {
film->sample_table[i].stream = film->audio_stream_index;
film->sample_table[i].pts = audio_frame_counter;
film->current_sample = 0;
return 0;
+fail:
+ film_read_close(s);
+ return ret;
}
static int film_read_packet(AVFormatContext *s,
return ret;
}
-static int film_read_close(AVFormatContext *s)
-{
- FilmDemuxContext *film = s->priv_data;
-
- av_free(film->sample_table);
- av_free(film->stereo_buffer);
-
- return 0;
-}
-
AVInputFormat ff_segafilm_demuxer = {
.name = "film_cpk",
.long_name = NULL_IF_CONFIG_SMALL("Sega FILM / CPK"),