X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavformat%2Fsierravmd.c;h=cfbf1843d43067f41b320e469d21027dc9c7f657;hb=3a370868dc33061a20d1fd99274e65167d7a78ac;hp=6960c2868fbeefd0f249da42179e8fe5939e6b1d;hpb=4069096dd535ee99175c2a29c1a1f59c3fc110c1;p=ffmpeg

diff --git a/libavformat/sierravmd.c b/libavformat/sierravmd.c
index 6960c2868fb..cfbf1843d43 100644
--- a/libavformat/sierravmd.c
+++ b/libavformat/sierravmd.c
@@ -38,10 +38,9 @@
 
 typedef struct vmd_frame {
   int stream_index;
-  int64_t frame_offset;
   unsigned int frame_size;
+  int64_t frame_offset;
   int64_t pts;
-  int keyframe;
   unsigned char frame_record[BYTES_PER_FRAME_RECORD];
 } vmd_frame;
 
@@ -62,7 +61,7 @@ typedef struct VmdDemuxContext {
     unsigned char vmd_header[VMD_HEADER_SIZE];
 } VmdDemuxContext;
 
-static int vmd_probe(AVProbeData *p)
+static int vmd_probe(const AVProbeData *p)
 {
     int w, h, sample_rate;
     if (p->buf_size < 806)
@@ -127,8 +126,8 @@ static int vmd_read_header(AVFormatContext *s)
             vst->codecpar->width >>= 1;
             vst->codecpar->height >>= 1;
         }
-        if (ff_alloc_extradata(vst->codecpar, VMD_HEADER_SIZE))
-            return AVERROR(ENOMEM);
+        if ((ret = ff_alloc_extradata(vst->codecpar, VMD_HEADER_SIZE)) < 0)
+            return ret;
         memcpy(vst->codecpar->extradata, vmd->vmd_header, VMD_HEADER_SIZE);
     }
 
@@ -174,6 +173,8 @@ static int vmd_read_header(AVFormatContext *s)
             avpriv_set_pts_info(vst, 33, num, den);
         avpriv_set_pts_info(st, 33, num, den);
     }
+    if (!s->nb_streams)
+        return AVERROR_INVALIDDATA;
 
     toc_offset = AV_RL32(&vmd->vmd_header[812]);
     vmd->frame_count = AV_RL16(&vmd->vmd_header[6]);
@@ -184,10 +185,6 @@ static int vmd_read_header(AVFormatContext *s)
     vmd->frame_table = NULL;
     sound_buffers = AV_RL16(&vmd->vmd_header[808]);
     raw_frame_table_size = vmd->frame_count * 6;
-    if(vmd->frame_count * vmd->frames_per_block >= UINT_MAX / sizeof(vmd_frame) - sound_buffers){
-        av_log(s, AV_LOG_ERROR, "vmd->frame_count * vmd->frames_per_block too large\n");
-        return -1;
-    }
     raw_frame_table = av_malloc(raw_frame_table_size);
     vmd->frame_table = av_malloc_array(vmd->frame_count * vmd->frames_per_block + sound_buffers, sizeof(vmd_frame));
     if (!raw_frame_table || !vmd->frame_table) {
@@ -241,6 +238,8 @@ static int vmd_read_header(AVFormatContext *s)
                     current_audio_pts++;
                 break;
             case 2: /* Video Chunk */
+                if (!vst)
+                    break;
                 vmd->frame_table[total_frames].frame_offset = current_offset;
                 vmd->frame_table[total_frames].stream_index = vmd->video_stream_index;
                 vmd->frame_table[total_frames].frame_size = size;
@@ -283,8 +282,9 @@ static int vmd_read_packet(AVFormatContext *s,
 
     if(ffio_limit(pb, frame->frame_size) != frame->frame_size)
         return AVERROR(EIO);
-    if (av_new_packet(pkt, frame->frame_size + BYTES_PER_FRAME_RECORD))
-        return AVERROR(ENOMEM);
+    ret = av_new_packet(pkt, frame->frame_size + BYTES_PER_FRAME_RECORD);
+    if (ret < 0)
+        return ret;
     pkt->pos= avio_tell(pb);
     memcpy(pkt->data, frame->frame_record, BYTES_PER_FRAME_RECORD);
     if(vmd->is_indeo3 && frame->frame_record[0] == 0x02)
@@ -294,7 +294,6 @@ static int vmd_read_packet(AVFormatContext *s,
             frame->frame_size);
 
     if (ret != frame->frame_size) {
-        av_packet_unref(pkt);
         ret = AVERROR(EIO);
     }
     pkt->stream_index = frame->stream_index;