* Based on http://wiki.multimedia.cx/index.php?title=Smacker
*/
+#include <inttypes.h>
+
#include "libavutil/bswap.h"
#include "libavutil/channel_layout.h"
#include "libavutil/intreadwrite.h"
smk->pad = avio_rl32(pb);
/* setup data */
if(smk->frames > 0xFFFFFF) {
- av_log(s, AV_LOG_ERROR, "Too many frames: %i\n", smk->frames);
+ av_log(s, AV_LOG_ERROR, "Too many frames: %"PRIu32"\n", smk->frames);
return -1;
}
smk->frm_size = av_malloc(smk->frames * 4);
FF_INPUT_BUFFER_PADDING_SIZE);
st->codec->extradata_size = smk->treesize + 16;
if(!st->codec->extradata){
- av_log(s, AV_LOG_ERROR, "Cannot allocate %i bytes of extradata\n", smk->treesize + 16);
+ av_log(s, AV_LOG_ERROR,
+ "Cannot allocate %"PRIu32" bytes of extradata\n",
+ smk->treesize + 16);
av_free(smk->frm_size);
av_free(smk->frm_flags);
return -1;
for(i = 0; i < 7; i++) {
if(flags & 1) {
uint32_t size;
- uint8_t *tmpbuf;
+ int err;
size = avio_rl32(s->pb) - 4;
if (!size || size > frame_size) {
frame_size -= size;
frame_size -= 4;
smk->curstream++;
- tmpbuf = av_realloc(smk->bufs[smk->curstream], size);
- if (!tmpbuf)
- return AVERROR(ENOMEM);
- smk->bufs[smk->curstream] = tmpbuf;
+ if ((err = av_reallocp(&smk->bufs[smk->curstream], size)) < 0) {
+ smk->buf_sizes[smk->curstream] = 0;
+ return err;
+ }
smk->buf_sizes[smk->curstream] = size;
ret = avio_read(s->pb, smk->bufs[smk->curstream], size);
if(ret != size)
}
flags >>= 1;
}
- if (frame_size < 0)
+ if (frame_size < 0 || frame_size >= INT_MAX/2)
return AVERROR_INVALIDDATA;
if (av_new_packet(pkt, frame_size + 769))
return AVERROR(ENOMEM);
smk->cur_frame++;
smk->nextpos = avio_tell(s->pb);
} else {
+ if (smk->stream_id[smk->curstream] < 0)
+ return AVERROR_INVALIDDATA;
if (av_new_packet(pkt, smk->buf_sizes[smk->curstream]))
return AVERROR(ENOMEM);
memcpy(pkt->data, smk->bufs[smk->curstream], smk->buf_sizes[smk->curstream]);