X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavformat%2Fadtsenc.c;h=ef3d8e2c21c2eb41fd70691e69544094a2f80950;hb=298a587f447fbc9103f66a50b8433aab977afc9b;hp=c2cb16112ce8278f0c9505d6a2c030ad20c574aa;hpb=ae628ec1fd7f54c102bf9e667a3edd404b9b9128;p=ffmpeg

diff --git a/libavformat/adtsenc.c b/libavformat/adtsenc.c
index c2cb16112ce..ef3d8e2c21c 100644
--- a/libavformat/adtsenc.c
+++ b/libavformat/adtsenc.c
@@ -3,20 +3,20 @@
  * Copyright (c) 2006 Baptiste Coudurier <baptiste.coudurier@smartjog.com>
  *                    Mans Rullgard <mans@mansr.com>
  *
- * This file is part of FFmpeg.
+ * This file is part of Libav.
  *
- * FFmpeg is free software; you can redistribute it and/or
+ * Libav is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
  * License as published by the Free Software Foundation; either
  * version 2.1 of the License, or (at your option) any later version.
  *
- * FFmpeg is distributed in the hope that it will be useful,
+ * Libav is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  * Lesser General Public License for more details.
  *
  * You should have received a copy of the GNU Lesser General Public
- * License along with FFmpeg; if not, write to the Free Software
+ * License along with Libav; if not, write to the Free Software
  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
  */
 
@@ -27,6 +27,8 @@
 #include "avformat.h"
 #include "adts.h"
 
+#define ADTS_MAX_FRAME_BYTES ((1 << 13) - 1)
+
 int ff_adts_decode_extradata(AVFormatContext *s, ADTSContext *adts, uint8_t *buf, int size)
 {
     GetBitContext gb;
@@ -35,7 +37,7 @@ int ff_adts_decode_extradata(AVFormatContext *s, ADTSContext *adts, uint8_t *buf
     int off;
 
     init_get_bits(&gb, buf, size * 8);
-    off = ff_mpeg4audio_get_config(&m4ac, buf, size);
+    off = avpriv_mpeg4audio_get_config(&m4ac, buf, size * 8, 1);
     if (off < 0)
         return off;
     skip_bits_long(&gb, off);
@@ -59,11 +61,15 @@ int ff_adts_decode_extradata(AVFormatContext *s, ADTSContext *adts, uint8_t *buf
         av_log(s, AV_LOG_ERROR, "Scalable configurations are not allowed in ADTS\n");
         return -1;
     }
+    if (get_bits(&gb, 1)) {
+        av_log(s, AV_LOG_ERROR, "Extension flag is not allowed in ADTS\n");
+        return -1;
+    }
     if (!adts->channel_conf) {
         init_put_bits(&pb, adts->pce_data, MAX_PCE_SIZE);
 
         put_bits(&pb, 3, 5); //ID_PCE
-        adts->pce_size = (ff_copy_pce_data(&pb, &gb) + 3) / 8;
+        adts->pce_size = (avpriv_copy_pce_data(&pb, &gb) + 3) / 8;
         flush_put_bits(&pb);
     }
 
@@ -89,6 +95,13 @@ int ff_adts_write_frame_header(ADTSContext *ctx,
 {
     PutBitContext pb;
 
+    unsigned full_frame_size = (unsigned)ADTS_HEADER_SIZE + size + pce_size;
+    if (full_frame_size > ADTS_MAX_FRAME_BYTES) {
+        av_log(NULL, AV_LOG_ERROR, "ADTS frame size too large: %u (max %d)\n",
+               full_frame_size, ADTS_MAX_FRAME_BYTES);
+        return AVERROR_INVALIDDATA;
+    }
+
     init_put_bits(&pb, buf, ADTS_HEADER_SIZE);
 
     /* adts_fixed_header */
@@ -106,7 +119,7 @@ int ff_adts_write_frame_header(ADTSContext *ctx,
     /* adts_variable_header */
     put_bits(&pb, 1, 0);        /* copyright_identification_bit */
     put_bits(&pb, 1, 0);        /* copyright_identification_start */
-    put_bits(&pb, 13, ADTS_HEADER_SIZE + size + pce_size); /* aac_frame_length */
+    put_bits(&pb, 13, full_frame_size); /* aac_frame_length */
     put_bits(&pb, 11, 0x7ff);   /* adts_buffer_fullness */
     put_bits(&pb, 2, 0);        /* number_of_raw_data_blocks_in_frame */
 
@@ -124,27 +137,30 @@ static int adts_write_packet(AVFormatContext *s, AVPacket *pkt)
     if (!pkt->size)
         return 0;
     if (adts->write_adts) {
-        ff_adts_write_frame_header(adts, buf, pkt->size, adts->pce_size);
-        put_buffer(pb, buf, ADTS_HEADER_SIZE);
+        int err = ff_adts_write_frame_header(adts, buf, pkt->size,
+                                             adts->pce_size);
+        if (err < 0)
+            return err;
+        avio_write(pb, buf, ADTS_HEADER_SIZE);
         if (adts->pce_size) {
-            put_buffer(pb, adts->pce_data, adts->pce_size);
+            avio_write(pb, adts->pce_data, adts->pce_size);
             adts->pce_size = 0;
         }
     }
-    put_buffer(pb, pkt->data, pkt->size);
-    put_flush_packet(pb);
+    avio_write(pb, pkt->data, pkt->size);
+    avio_flush(pb);
 
     return 0;
 }
 
 AVOutputFormat ff_adts_muxer = {
-    "adts",
-    NULL_IF_CONFIG_SMALL("ADTS AAC"),
-    "audio/aac",
-    "aac,adts",
-    sizeof(ADTSContext),
-    CODEC_ID_AAC,
-    CODEC_ID_NONE,
-    adts_write_header,
-    adts_write_packet,
+    .name              = "adts",
+    .long_name         = NULL_IF_CONFIG_SMALL("ADTS AAC"),
+    .mime_type         = "audio/aac",
+    .extensions        = "aac,adts",
+    .priv_data_size    = sizeof(ADTSContext),
+    .audio_codec       = CODEC_ID_AAC,
+    .video_codec       = CODEC_ID_NONE,
+    .write_header      = adts_write_header,
+    .write_packet      = adts_write_packet,
 };