X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavformat%2Fiff.c;h=f0176846207f83ab9e4272f726f46725e4192941;hb=50b49f833ae2f7d33bd2a99776fed6cb692c171a;hp=f4d806b7b8d910391ec59ca0d3a5fead69d3e807;hpb=4d8875ec23cf299277a0f028ea2ac99eb6f603c9;p=ffmpeg

diff --git a/libavformat/iff.c b/libavformat/iff.c
index f4d806b7b8d..f0176846207 100644
--- a/libavformat/iff.c
+++ b/libavformat/iff.c
@@ -223,6 +223,9 @@ static int parse_dsd_diin(AVFormatContext *s, AVStream *st, uint64_t eof)
         uint64_t orig_pos = avio_tell(pb);
         const char * metadata_tag = NULL;
 
+        if (size >= INT64_MAX)
+            return AVERROR_INVALIDDATA;
+
         switch(tag) {
         case MKTAG('D','I','A','R'): metadata_tag = "artist"; break;
         case MKTAG('D','I','T','I'): metadata_tag = "title";  break;
@@ -256,6 +259,9 @@ static int parse_dsd_prop(AVFormatContext *s, AVStream *st, uint64_t eof)
         uint64_t size     = avio_rb64(pb);
         uint64_t orig_pos = avio_tell(pb);
 
+        if (size >= INT64_MAX)
+            return AVERROR_INVALIDDATA;
+
         switch(tag) {
         case MKTAG('A','B','S','S'):
             if (size < 8)
@@ -312,8 +318,8 @@ static int parse_dsd_prop(AVFormatContext *s, AVStream *st, uint64_t eof)
             id3v2_extra_meta = NULL;
             ff_id3v2_read(s, ID3v2_DEFAULT_MAGIC, &id3v2_extra_meta, size);
             if (id3v2_extra_meta) {
-                if ((ret = ff_id3v2_parse_apic(s, &id3v2_extra_meta)) < 0 ||
-                    (ret = ff_id3v2_parse_chapters(s, &id3v2_extra_meta)) < 0) {
+                if ((ret = ff_id3v2_parse_apic(s, id3v2_extra_meta)) < 0 ||
+                    (ret = ff_id3v2_parse_chapters(s, id3v2_extra_meta)) < 0) {
                     ff_id3v2_free_extra_meta(&id3v2_extra_meta);
                     return ret;
                 }
@@ -449,6 +455,9 @@ static int iff_read_header(AVFormatContext *s)
         data_size = iff->is_64bit ? avio_rb64(pb) : avio_rb32(pb);
         orig_pos = avio_tell(pb);
 
+        if (data_size >= INT64_MAX)
+            return AVERROR_INVALIDDATA;
+
         switch(chunk_id) {
         case ID_VHDR:
             st->codecpar->codec_type = AVMEDIA_TYPE_AUDIO;
@@ -525,12 +534,15 @@ static int iff_read_header(AVFormatContext *s)
                         data_size);
                  return AVERROR_INVALIDDATA;
             }
-            st->codecpar->extradata_size = data_size + IFF_EXTRA_VIDEO_SIZE;
-            st->codecpar->extradata      = av_malloc(data_size + IFF_EXTRA_VIDEO_SIZE + AV_INPUT_BUFFER_PADDING_SIZE);
-            if (!st->codecpar->extradata)
-                return AVERROR(ENOMEM);
-            if (avio_read(pb, st->codecpar->extradata + IFF_EXTRA_VIDEO_SIZE, data_size) < 0)
+            res = ff_alloc_extradata(st->codecpar,
+                                     data_size + IFF_EXTRA_VIDEO_SIZE);
+            if (res < 0)
+                return res;
+            if (avio_read(pb, st->codecpar->extradata + IFF_EXTRA_VIDEO_SIZE, data_size) < 0) {
+                av_freep(&st->codecpar->extradata);
+                st->codecpar->extradata_size = 0;
                 return AVERROR(EIO);
+            }
             break;
 
         case ID_BMHD:
@@ -768,10 +780,9 @@ static int iff_read_header(AVFormatContext *s)
         iff->transparency = transparency;
 
         if (!st->codecpar->extradata) {
-            st->codecpar->extradata_size = IFF_EXTRA_VIDEO_SIZE;
-            st->codecpar->extradata      = av_malloc(IFF_EXTRA_VIDEO_SIZE + AV_INPUT_BUFFER_PADDING_SIZE);
-            if (!st->codecpar->extradata)
-                return AVERROR(ENOMEM);
+            int ret = ff_alloc_extradata(st->codecpar, IFF_EXTRA_VIDEO_SIZE);
+            if (ret < 0)
+                return ret;
         }
         av_assert0(st->codecpar->extradata_size >= IFF_EXTRA_VIDEO_SIZE);
         buf = st->codecpar->extradata;
@@ -834,7 +845,7 @@ static int iff_read_packet(AVFormatContext *s,
         } else if (st->codecpar->codec_tag == ID_DST) {
             return read_dst_frame(s, pkt);
         } else {
-            if (iff->body_size > INT_MAX)
+            if (iff->body_size > INT_MAX || !iff->body_size)
                 return AVERROR_INVALIDDATA;
             ret = av_get_packet(pb, pkt, iff->body_size);
         }
@@ -870,6 +881,8 @@ static int iff_read_packet(AVFormatContext *s,
             pkt->flags |= AV_PKT_FLAG_KEY;
     } else if (st->codecpar->codec_type == AVMEDIA_TYPE_VIDEO &&
                st->codecpar->codec_tag  != ID_ANIM) {
+        if (iff->body_size > INT_MAX || !iff->body_size)
+            return AVERROR_INVALIDDATA;
         ret = av_get_packet(pb, pkt, iff->body_size);
         pkt->pos = pos;
         if (pos == iff->body_pos)