X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavformat%2Fbintext.c;h=bc0f6bd099fd7d4929d3d4579fdaeb76d5b62135;hb=a247ac640df3da573cd661065bf53f37863e2b46;hp=d4921749a073ed63751a959f5b5bbee70d180967;hpb=e645d7a6d452df83cedcbb1d6708429ceea156da;p=ffmpeg

diff --git a/libavformat/bintext.c b/libavformat/bintext.c
index d4921749a07..bc0f6bd099f 100644
--- a/libavformat/bintext.c
+++ b/libavformat/bintext.c
@@ -149,7 +149,7 @@ static int bin_probe(const AVProbeData *p)
             return AVPROBE_SCORE_EXTENSION + 1;
 
         predict_width(&par, p->buf_size, got_width);
-        if (par.width <= 0)
+        if (par.width < 8)
             return 0;
         calculate_height(&par, p->buf_size);
         if (par.height <= 0)
@@ -177,14 +177,14 @@ static int bintext_read_header(AVFormatContext *s)
 {
     BinDemuxContext *bin = s->priv_data;
     AVIOContext *pb = s->pb;
-
+    int ret;
     AVStream *st = init_stream(s);
     if (!st)
         return AVERROR(ENOMEM);
     st->codecpar->codec_id    = AV_CODEC_ID_BINTEXT;
 
-    if (ff_alloc_extradata(st->codecpar, 2))
-        return AVERROR(ENOMEM);
+    if ((ret = ff_alloc_extradata(st->codecpar, 2)) < 0)
+        return ret;
     st->codecpar->extradata[0] = 16;
     st->codecpar->extradata[1] = 0;
 
@@ -195,6 +195,8 @@ static int bintext_read_header(AVFormatContext *s)
             next_tag_read(s, &bin->fsize);
         if (!bin->width) {
             predict_width(st->codecpar, bin->fsize, got_width);
+            if (st->codecpar->width < 8)
+                return AVERROR_INVALIDDATA;
             calculate_height(st->codecpar, bin->fsize);
         }
         avio_seek(pb, 0, SEEK_SET);
@@ -220,7 +222,7 @@ static int xbin_read_header(AVFormatContext *s)
     BinDemuxContext *bin = s->priv_data;
     AVIOContext *pb = s->pb;
     char fontheight, flags;
-
+    int ret;
     AVStream *st = init_stream(s);
     if (!st)
         return AVERROR(ENOMEM);
@@ -239,8 +241,9 @@ static int xbin_read_header(AVFormatContext *s)
         st->codecpar->extradata_size += fontheight * (flags & 0x10 ? 512 : 256);
     st->codecpar->codec_id    = flags & 4 ? AV_CODEC_ID_XBIN : AV_CODEC_ID_BINTEXT;
 
-    if (ff_alloc_extradata(st->codecpar, st->codecpar->extradata_size))
-        return AVERROR(ENOMEM);
+    ret = ff_alloc_extradata(st->codecpar, st->codecpar->extradata_size);
+    if (ret < 0)
+        return ret;
     st->codecpar->extradata[0] = fontheight;
     st->codecpar->extradata[1] = flags;
     if (avio_read(pb, st->codecpar->extradata + 2, st->codecpar->extradata_size - 2) < 0)
@@ -262,6 +265,7 @@ static int adf_read_header(AVFormatContext *s)
     BinDemuxContext *bin = s->priv_data;
     AVIOContext *pb = s->pb;
     AVStream *st;
+    int ret;
 
     if (avio_r8(pb) != 1)
         return AVERROR_INVALIDDATA;
@@ -271,8 +275,8 @@ static int adf_read_header(AVFormatContext *s)
         return AVERROR(ENOMEM);
     st->codecpar->codec_id    = AV_CODEC_ID_BINTEXT;
 
-    if (ff_alloc_extradata(st->codecpar, 2 + 48 + 4096))
-        return AVERROR(ENOMEM);
+    if ((ret = ff_alloc_extradata(st->codecpar, 2 + 48 + 4096)) < 0)
+        return ret;
     st->codecpar->extradata[0] = 16;
     st->codecpar->extradata[1] = BINTEXT_PALETTE|BINTEXT_FONT;
 
@@ -289,6 +293,8 @@ static int adf_read_header(AVFormatContext *s)
         bin->fsize = avio_size(pb) - 1 - 192 - 4096;
         st->codecpar->width = 80<<3;
         ff_sauce_read(s, &bin->fsize, &got_width, 0);
+        if (st->codecpar->width < 8)
+            return AVERROR_INVALIDDATA;
         if (!bin->width)
             calculate_height(st->codecpar, bin->fsize);
         avio_seek(pb, 1 + 192 + 4096, SEEK_SET);
@@ -316,7 +322,7 @@ static int idf_read_header(AVFormatContext *s)
     BinDemuxContext *bin = s->priv_data;
     AVIOContext *pb = s->pb;
     AVStream *st;
-    int got_width = 0;
+    int got_width = 0, ret;
 
     if (!(pb->seekable & AVIO_SEEKABLE_NORMAL))
         return AVERROR(EIO);
@@ -326,8 +332,8 @@ static int idf_read_header(AVFormatContext *s)
         return AVERROR(ENOMEM);
     st->codecpar->codec_id    = AV_CODEC_ID_IDF;
 
-    if (ff_alloc_extradata(st->codecpar, 2 + 48 + 4096))
-        return AVERROR(ENOMEM);
+    if ((ret = ff_alloc_extradata(st->codecpar, 2 + 48 + 4096)) < 0)
+        return ret;
     st->codecpar->extradata[0] = 16;
     st->codecpar->extradata[1] = BINTEXT_PALETTE|BINTEXT_FONT;
 
@@ -340,6 +346,8 @@ static int idf_read_header(AVFormatContext *s)
 
     bin->fsize = avio_size(pb) - 12 - 4096 - 48;
     ff_sauce_read(s, &bin->fsize, &got_width, 0);
+    if (st->codecpar->width < 8)
+        return AVERROR_INVALIDDATA;
     if (!bin->width)
         calculate_height(st->codecpar, bin->fsize);
     avio_seek(pb, 12, SEEK_SET);