X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavformat%2Fbintext.c;h=bc0f6bd099fd7d4929d3d4579fdaeb76d5b62135;hb=626535f6a169e2d821b969e0ea77125ba7482113;hp=0b499d9555ed8d84cd376c4098a170f362c74406;hpb=ace96d2e693d804a0ed16aebc1b1027cfff2c527;p=ffmpeg

diff --git a/libavformat/bintext.c b/libavformat/bintext.c
index 0b499d9555e..bc0f6bd099f 100644
--- a/libavformat/bintext.c
+++ b/libavformat/bintext.c
@@ -126,7 +126,7 @@ static void predict_width(AVCodecParameters *par, uint64_t fsize, int got_width)
         par->width = fsize > 4000 ? (160<<3) : (80<<3);
 }
 
-static int bin_probe(AVProbeData *p)
+static int bin_probe(const AVProbeData *p)
 {
     const uint8_t *d = p->buf;
     int magic = 0, sauce = 0;
@@ -149,7 +149,7 @@ static int bin_probe(AVProbeData *p)
             return AVPROBE_SCORE_EXTENSION + 1;
 
         predict_width(&par, p->buf_size, got_width);
-        if (par.width <= 0)
+        if (par.width < 8)
             return 0;
         calculate_height(&par, p->buf_size);
         if (par.height <= 0)
@@ -177,14 +177,14 @@ static int bintext_read_header(AVFormatContext *s)
 {
     BinDemuxContext *bin = s->priv_data;
     AVIOContext *pb = s->pb;
-
+    int ret;
     AVStream *st = init_stream(s);
     if (!st)
         return AVERROR(ENOMEM);
     st->codecpar->codec_id    = AV_CODEC_ID_BINTEXT;
 
-    if (ff_alloc_extradata(st->codecpar, 2))
-        return AVERROR(ENOMEM);
+    if ((ret = ff_alloc_extradata(st->codecpar, 2)) < 0)
+        return ret;
     st->codecpar->extradata[0] = 16;
     st->codecpar->extradata[1] = 0;
 
@@ -195,6 +195,8 @@ static int bintext_read_header(AVFormatContext *s)
             next_tag_read(s, &bin->fsize);
         if (!bin->width) {
             predict_width(st->codecpar, bin->fsize, got_width);
+            if (st->codecpar->width < 8)
+                return AVERROR_INVALIDDATA;
             calculate_height(st->codecpar, bin->fsize);
         }
         avio_seek(pb, 0, SEEK_SET);
@@ -204,7 +206,7 @@ static int bintext_read_header(AVFormatContext *s)
 #endif /* CONFIG_BINTEXT_DEMUXER */
 
 #if CONFIG_XBIN_DEMUXER
-static int xbin_probe(AVProbeData *p)
+static int xbin_probe(const AVProbeData *p)
 {
     const uint8_t *d = p->buf;
 
@@ -220,7 +222,7 @@ static int xbin_read_header(AVFormatContext *s)
     BinDemuxContext *bin = s->priv_data;
     AVIOContext *pb = s->pb;
     char fontheight, flags;
-
+    int ret;
     AVStream *st = init_stream(s);
     if (!st)
         return AVERROR(ENOMEM);
@@ -239,8 +241,9 @@ static int xbin_read_header(AVFormatContext *s)
         st->codecpar->extradata_size += fontheight * (flags & 0x10 ? 512 : 256);
     st->codecpar->codec_id    = flags & 4 ? AV_CODEC_ID_XBIN : AV_CODEC_ID_BINTEXT;
 
-    if (ff_alloc_extradata(st->codecpar, st->codecpar->extradata_size))
-        return AVERROR(ENOMEM);
+    ret = ff_alloc_extradata(st->codecpar, st->codecpar->extradata_size);
+    if (ret < 0)
+        return ret;
     st->codecpar->extradata[0] = fontheight;
     st->codecpar->extradata[1] = flags;
     if (avio_read(pb, st->codecpar->extradata + 2, st->codecpar->extradata_size - 2) < 0)
@@ -262,6 +265,7 @@ static int adf_read_header(AVFormatContext *s)
     BinDemuxContext *bin = s->priv_data;
     AVIOContext *pb = s->pb;
     AVStream *st;
+    int ret;
 
     if (avio_r8(pb) != 1)
         return AVERROR_INVALIDDATA;
@@ -271,8 +275,8 @@ static int adf_read_header(AVFormatContext *s)
         return AVERROR(ENOMEM);
     st->codecpar->codec_id    = AV_CODEC_ID_BINTEXT;
 
-    if (ff_alloc_extradata(st->codecpar, 2 + 48 + 4096))
-        return AVERROR(ENOMEM);
+    if ((ret = ff_alloc_extradata(st->codecpar, 2 + 48 + 4096)) < 0)
+        return ret;
     st->codecpar->extradata[0] = 16;
     st->codecpar->extradata[1] = BINTEXT_PALETTE|BINTEXT_FONT;
 
@@ -289,6 +293,8 @@ static int adf_read_header(AVFormatContext *s)
         bin->fsize = avio_size(pb) - 1 - 192 - 4096;
         st->codecpar->width = 80<<3;
         ff_sauce_read(s, &bin->fsize, &got_width, 0);
+        if (st->codecpar->width < 8)
+            return AVERROR_INVALIDDATA;
         if (!bin->width)
             calculate_height(st->codecpar, bin->fsize);
         avio_seek(pb, 1 + 192 + 4096, SEEK_SET);
@@ -302,7 +308,7 @@ static const uint8_t idf_magic[] = {
     0x04, 0x31, 0x2e, 0x34, 0x00, 0x00, 0x00, 0x00, 0x4f, 0x00, 0x15, 0x00
 };
 
-static int idf_probe(AVProbeData *p)
+static int idf_probe(const AVProbeData *p)
 {
     if (p->buf_size < sizeof(idf_magic))
         return 0;
@@ -316,7 +322,7 @@ static int idf_read_header(AVFormatContext *s)
     BinDemuxContext *bin = s->priv_data;
     AVIOContext *pb = s->pb;
     AVStream *st;
-    int got_width = 0;
+    int got_width = 0, ret;
 
     if (!(pb->seekable & AVIO_SEEKABLE_NORMAL))
         return AVERROR(EIO);
@@ -326,8 +332,8 @@ static int idf_read_header(AVFormatContext *s)
         return AVERROR(ENOMEM);
     st->codecpar->codec_id    = AV_CODEC_ID_IDF;
 
-    if (ff_alloc_extradata(st->codecpar, 2 + 48 + 4096))
-        return AVERROR(ENOMEM);
+    if ((ret = ff_alloc_extradata(st->codecpar, 2 + 48 + 4096)) < 0)
+        return ret;
     st->codecpar->extradata[0] = 16;
     st->codecpar->extradata[1] = BINTEXT_PALETTE|BINTEXT_FONT;
 
@@ -340,6 +346,8 @@ static int idf_read_header(AVFormatContext *s)
 
     bin->fsize = avio_size(pb) - 12 - 4096 - 48;
     ff_sauce_read(s, &bin->fsize, &got_width, 0);
+    if (st->codecpar->width < 8)
+        return AVERROR_INVALIDDATA;
     if (!bin->width)
         calculate_height(st->codecpar, bin->fsize);
     avio_seek(pb, 12, SEEK_SET);