]> git.sesse.net Git - ffmpeg/blobdiff - libavformat/sierravmd.c
sanity checks some might have been exploitable
[ffmpeg] / libavformat / sierravmd.c
index 09b7a7491a8e97c7953428be639cae09c031bbaf..fd75fc8d7689f9b6fd7e0b1e0fea163b13b94513 100644 (file)
@@ -14,7 +14,7 @@
  *
  * You should have received a copy of the GNU Lesser General Public
  * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
  */
 
 /**
@@ -49,6 +49,7 @@ typedef struct VmdDemuxContext {
     unsigned int audio_channels;
 
     unsigned int frame_count;
+    unsigned int frames_per_block;
     vmd_frame_t *frame_table;
     unsigned int current_frame;
 
@@ -56,6 +57,7 @@ typedef struct VmdDemuxContext {
     int64_t audio_sample_counter;
     int audio_frame_divisor;
     int audio_block_align;
+    int skiphdr;
 
     unsigned char vmd_header[VMD_HEADER_SIZE];
 } VmdDemuxContext;
@@ -87,6 +89,10 @@ static int vmd_calculate_audio_duration(unsigned char *audio_chunk,
 
     if (audio_chunk_size < 16)
         return 0;
+    if (audio_chunk_size == block_align + 16)
+        return block_align;
+    if (audio_chunk_size == block_align + 17)
+        return block_align;
 
     sound_flags = LE_32(p);
     p += 4;
@@ -96,6 +102,7 @@ static int vmd_calculate_audio_duration(unsigned char *audio_chunk,
             p += block_align;
         sound_flags >>= 1;
     }
+    av_log(NULL,0,"Got %i samples for size %i map %08X\n", total_samples, audio_chunk_size, LE_32(audio_chunk));
 
     return total_samples;
 }
@@ -109,12 +116,13 @@ static int vmd_read_header(AVFormatContext *s,
     unsigned int toc_offset;
     unsigned char *raw_frame_table;
     int raw_frame_table_size;
-    unsigned char *current_frame_record;
     offset_t current_offset;
-    int i;
+    int i, j;
     unsigned int total_frames;
-    int64_t video_pts_inc;
+    int64_t video_pts_inc = 0;
     int64_t current_video_pts = 0;
+    unsigned char chunk[BYTES_PER_FRAME_RECORD];
+    int lastframe = 0;
 
     /* fetch the main header, including the 2 header length bytes */
     url_fseek(pb, 0, SEEK_SET);
@@ -131,14 +139,16 @@ static int vmd_read_header(AVFormatContext *s,
         return AVERROR_NOMEM;
     av_set_pts_info(st, 33, 1, 90000);
     vmd->video_stream_index = st->index;
-    st->codec.codec_type = CODEC_TYPE_VIDEO;
-    st->codec.codec_id = CODEC_ID_VMDVIDEO;
-    st->codec.codec_tag = 0;  /* no fourcc */
-    st->codec.width = LE_16(&vmd->vmd_header[12]);
-    st->codec.height = LE_16(&vmd->vmd_header[14]);
-    st->codec.extradata_size = VMD_HEADER_SIZE;
-    st->codec.extradata = av_malloc(VMD_HEADER_SIZE);
-    memcpy(st->codec.extradata, vmd->vmd_header, VMD_HEADER_SIZE);
+    st->codec->codec_type = CODEC_TYPE_VIDEO;
+    st->codec->codec_id = CODEC_ID_VMDVIDEO;
+    st->codec->codec_tag = 0;  /* no fourcc */
+    st->codec->width = LE_16(&vmd->vmd_header[12]);
+    st->codec->height = LE_16(&vmd->vmd_header[14]);
+    st->codec->time_base.num = 1;
+    st->codec->time_base.den = 10;
+    st->codec->extradata_size = VMD_HEADER_SIZE;
+    st->codec->extradata = av_mallocz(VMD_HEADER_SIZE + FF_INPUT_BUFFER_PADDING_SIZE);
+    memcpy(st->codec->extradata, vmd->vmd_header, VMD_HEADER_SIZE);
 
     /* if sample rate is 0, assume no audio */
     vmd->sample_rate = LE_16(&vmd->vmd_header[804]);
@@ -148,106 +158,106 @@ static int vmd_read_header(AVFormatContext *s,
             return AVERROR_NOMEM;
         av_set_pts_info(st, 33, 1, 90000);
         vmd->audio_stream_index = st->index;
-        st->codec.codec_type = CODEC_TYPE_AUDIO;
-        st->codec.codec_id = CODEC_ID_VMDAUDIO;
-        st->codec.codec_tag = 0;  /* no codec tag */
-        st->codec.channels = (vmd->vmd_header[811] & 0x80) ? 2 : 1;
-        st->codec.sample_rate = vmd->sample_rate;
-        st->codec.block_align = vmd->audio_block_align = 
+        st->codec->codec_type = CODEC_TYPE_AUDIO;
+        st->codec->codec_id = CODEC_ID_VMDAUDIO;
+        st->codec->codec_tag = 0;  /* no fourcc */
+        st->codec->channels = vmd->audio_channels = (vmd->vmd_header[811] & 0x80) ? 2 : 1;
+        st->codec->sample_rate = vmd->sample_rate;
+        st->codec->block_align = vmd->audio_block_align =
             LE_16(&vmd->vmd_header[806]);
-        if (st->codec.block_align & 0x8000) {
-            st->codec.bits_per_sample = 16;
-            st->codec.block_align = -(st->codec.block_align - 0x10000);
-        } else
-            st->codec.bits_per_sample = 16;
-//            st->codec.bits_per_sample = 8;
-        st->codec.bit_rate = st->codec.sample_rate * 
-            st->codec.bits_per_sample * st->codec.channels;
+        if (st->codec->block_align & 0x8000) {
+            st->codec->bits_per_sample = 16;
+            st->codec->block_align = -(st->codec->block_align - 0x10000);
+            vmd->audio_block_align = -(vmd->audio_block_align - 0x10000);
+        } else {
+            st->codec->bits_per_sample = 8;
+        }
+        st->codec->bit_rate = st->codec->sample_rate *
+            st->codec->bits_per_sample * st->codec->channels;
 
         /* for calculating pts */
-        vmd->audio_frame_divisor = st->codec.bits_per_sample / 8 / 
-            st->codec.channels;
+        vmd->audio_frame_divisor = st->codec->channels;
 
         video_pts_inc = 90000;
-        video_pts_inc *= st->codec.block_align;
-        video_pts_inc /= st->codec.sample_rate;
+        video_pts_inc *= st->codec->block_align;
+        video_pts_inc /= st->codec->sample_rate;
+        video_pts_inc /= st->codec->channels;
     } else {
         /* if no audio, assume 10 frames/second */
         video_pts_inc = 90000 / 10;
     }
 
-    /* skip over the offset table and load the table of contents; don't 
-     * care about the offset table since demuxer will calculate those 
-     * independently */
     toc_offset = LE_32(&vmd->vmd_header[812]);
     vmd->frame_count = LE_16(&vmd->vmd_header[6]);
-    url_fseek(pb, toc_offset + vmd->frame_count * 6, SEEK_SET);
+    vmd->frames_per_block = LE_16(&vmd->vmd_header[18]);
+    url_fseek(pb, toc_offset, SEEK_SET);
 
-    /* each on-disk VMD frame has an audio part and a video part; demuxer
-     * accounts them separately */
-    if(vmd->sample_rate)
-       vmd->frame_count *= 2;
     raw_frame_table = NULL;
     vmd->frame_table = NULL;
-    raw_frame_table_size = vmd->frame_count * BYTES_PER_FRAME_RECORD;
+    raw_frame_table_size = vmd->frame_count * 6;
     raw_frame_table = av_malloc(raw_frame_table_size);
-    vmd->frame_table = av_malloc(vmd->frame_count * sizeof(vmd_frame_t));
+    if(vmd->frame_count * vmd->frames_per_block  >= UINT_MAX / sizeof(vmd_frame_t)){
+        av_log(s, AV_LOG_ERROR, "vmd->frame_count * vmd->frames_per_block too large\n");
+        return -1;
+    }
+    vmd->frame_table = av_malloc(vmd->frame_count * vmd->frames_per_block * sizeof(vmd_frame_t));
     if (!raw_frame_table || !vmd->frame_table) {
         av_free(raw_frame_table);
         av_free(vmd->frame_table);
         return AVERROR_NOMEM;
     }
-    if (get_buffer(pb, raw_frame_table, raw_frame_table_size) != 
+    if (get_buffer(pb, raw_frame_table, raw_frame_table_size) !=
         raw_frame_table_size) {
         av_free(raw_frame_table);
         av_free(vmd->frame_table);
         return AVERROR_IO;
     }
 
-    current_offset = LE_32(&vmd->vmd_header[20]);
-    current_frame_record = raw_frame_table;
-    total_frames = vmd->frame_count;
-    i = 0;
-    while (total_frames--) {
-
-        /* if the frame size is 0, do not count the frame and bring the
-         * total frame count down */
-        // note, we limit the size to 1Gb to ensure that we dont end up overflowing the size integer used to allocate the memory
-        vmd->frame_table[i].frame_size = LE_32(&current_frame_record[2]) & 0x3FFFFFFF; 
-
-        /* this logic is present so that 0-length audio chunks are not
-         * accounted */
-        if (!vmd->frame_table[i].frame_size) {
-            vmd->frame_count--;  /* one less frame to count */
-            current_frame_record += BYTES_PER_FRAME_RECORD;
-            continue;
+    total_frames = 0;
+    for (i = 0; i < vmd->frame_count; i++) {
+
+        current_offset = LE_32(&raw_frame_table[6 * i + 2]);
+
+        /* handle each entry in index block */
+        for (j = 0; j < vmd->frames_per_block; j++) {
+            int type;
+            uint32_t size;
+
+            get_buffer(pb, chunk, BYTES_PER_FRAME_RECORD);
+            type = chunk[0];
+            size = LE_32(&chunk[2]);
+            if(!size)
+                continue;
+            switch(type) {
+            case 1: /* Audio Chunk */
+                vmd->frame_table[total_frames].frame_offset = current_offset;
+                vmd->frame_table[total_frames].stream_index = vmd->audio_stream_index;
+                vmd->frame_table[total_frames].frame_size = size;
+                memcpy(vmd->frame_table[total_frames].frame_record, chunk, BYTES_PER_FRAME_RECORD);
+                total_frames++;
+                break;
+            case 2: /* Video Chunk */
+                vmd->frame_table[total_frames].frame_offset = current_offset;
+                vmd->frame_table[total_frames].frame_size = size;
+                vmd->frame_table[total_frames].stream_index = vmd->video_stream_index;
+                memcpy(vmd->frame_table[total_frames].frame_record, chunk, BYTES_PER_FRAME_RECORD);
+                vmd->frame_table[total_frames].pts = current_video_pts;
+                if (lastframe) {
+                    vmd->frame_table[lastframe].pts = current_video_pts - video_pts_inc;
+                }
+                lastframe = total_frames;
+                total_frames++;
+                break;
+            }
+            current_offset += size;
         }
-
-        if (current_frame_record[0] == 0x02)
-            vmd->frame_table[i].stream_index = vmd->video_stream_index;
-        else
-            vmd->frame_table[i].stream_index = vmd->audio_stream_index;
-        vmd->frame_table[i].frame_offset = current_offset;
-        current_offset += vmd->frame_table[i].frame_size;
-        memcpy(vmd->frame_table[i].frame_record, current_frame_record,
-            BYTES_PER_FRAME_RECORD);
-
-        /* figure out the pts for this frame */
-        if (current_frame_record[0] == 0x02) {
-            vmd->frame_table[i].pts = current_video_pts;
-            current_video_pts += video_pts_inc;
-        } else if (current_frame_record[0] == 0x01) {
-            /* figure out the pts during the dispatch phase */
-            vmd->frame_table[i].pts = 0;
-        }
-
-        current_frame_record += BYTES_PER_FRAME_RECORD;
-        i++;
+        current_video_pts += video_pts_inc;
     }
 
     av_free(raw_frame_table);
 
     vmd->current_frame = 0;
+    vmd->frame_count = total_frames;
 
     return 0;
 }
@@ -271,7 +281,7 @@ static int vmd_read_packet(AVFormatContext *s,
         return AVERROR_NOMEM;
     pkt->pos= url_ftell(pb);
     memcpy(pkt->data, frame->frame_record, BYTES_PER_FRAME_RECORD);
-    ret = get_buffer(pb, pkt->data + BYTES_PER_FRAME_RECORD, 
+    ret = get_buffer(pb, pkt->data + BYTES_PER_FRAME_RECORD,
         frame->frame_size);
 
     if (ret != frame->frame_size) {
@@ -285,12 +295,12 @@ static int vmd_read_packet(AVFormatContext *s,
         pkt->pts = vmd->audio_sample_counter;
         pkt->pts *= 90000;
         pkt->pts /= vmd->sample_rate;
-//        pkt->pts /= vmd->audio_frame_divisor;
+        pkt->pts /= vmd->audio_channels;
         vmd->audio_sample_counter += vmd_calculate_audio_duration(
             pkt->data, pkt->size, vmd->audio_block_align);
 
     }
-av_log(NULL, AV_LOG_INFO, " dispatching %s frame with %d bytes and pts %lld (%0.1f sec)\n",
+av_log(NULL, AV_LOG_INFO, " dispatching %s frame with %d bytes and pts %"PRId64" (%0.1f sec)\n",
   (frame->frame_record[0] == 0x02) ? "video" : "audio",
   frame->frame_size + BYTES_PER_FRAME_RECORD,
   pkt->pts, (float)(pkt->pts / 90000.0));