X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavformat%2Fvividas.c;h=4f54a4302e1356632ede417351231a21045d0ddd;hb=39fb1e968a5a8bd62bb454a5291d877a6ddd726c;hp=598b8bb10b089fc4eca2723e0a09b346826e875d;hpb=d6b62ce1aced9e2456582870382f384581cc7cbb;p=ffmpeg diff --git a/libavformat/vividas.c b/libavformat/vividas.c index 598b8bb10b0..4f54a4302e1 100644 --- a/libavformat/vividas.c +++ b/libavformat/vividas.c @@ -52,6 +52,7 @@ typedef struct VIV_AudioSubpacket { typedef struct VividasDemuxContext { int n_sb_blocks; VIV_SB_block *sb_blocks; + int num_audio; uint32_t sb_key; int64_t sb_offset; @@ -70,7 +71,7 @@ typedef struct VividasDemuxContext { VIV_AudioSubpacket audio_subpackets[MAX_AUDIO_SUBPACKETS]; } VividasDemuxContext; -static int viv_probe(AVProbeData *p) +static int viv_probe(const AVProbeData *p) { if (memcmp(p->buf, "vividas03", 9)) return 0; @@ -78,11 +79,11 @@ static int viv_probe(AVProbeData *p) return AVPROBE_SCORE_MAX; } -static const unsigned short keybits[32] = { - 163, 416, 893, 82, 223, 572, 1137, 430, - 659, 1104, 13, 626, 695, 972, 1465, 686, - 843, 1216, 317, 1122, 1383, 92, 513, 1158, - 1243, 48, 573, 1306, 1495, 396, 1009, 350, +static const uint8_t keybits[32] = { + 20, 52, 111, 10, 27, 71, 142, 53, + 82, 138, 1, 78, 86, 121, 183, 85, +105, 152, 39, 140, 172, 11, 64, 144, +155, 6, 71, 163, 186, 49, 126, 43, }; static uint32_t decode_key(uint8_t *buf) @@ -91,7 +92,7 @@ static uint32_t decode_key(uint8_t *buf) for (int i = 0; i < 32; i++) { unsigned p = keybits[i]; - key |= !!(buf[p>>3] & (1<<(p&7))) << i; + key |= ((buf[p] >> ((i*5+3)&7)) & 1u) << i; } return key; @@ -115,10 +116,7 @@ static unsigned recover_key(unsigned char sample[4], unsigned expected_size) put_v(plaintext+2, expected_size); - return (sample[0]^plaintext[0])| - ((sample[1]^plaintext[1])<<8)| - ((sample[2]^plaintext[2])<<16)| - ((sample[3]^plaintext[3])<<24); + return AV_RL32(sample) ^ AV_RL32(plaintext); } static void xor_block(void *p1, void *p2, unsigned size, int key, unsigned *key_ptr) @@ -156,6 +154,10 @@ static void decode_block(uint8_t *src, uint8_t *dest, unsigned size, if (align) { uint32_t tmpkey = *key_ptr - key; + if (a2 > s) { + a2 = s; + avpriv_request_sample(NULL, "tiny aligned block\n"); + } memcpy(tmp + align, src, a2); xor_block(tmp, tmp, 4, key, &tmpkey); memcpy(dest, tmp + align, a2); @@ -163,8 +165,6 @@ static void decode_block(uint8_t *src, uint8_t *dest, unsigned size, } if (s >= 4) { - if (!align) - align = 4; xor_block(src + a2, dest + a2, s & ~3, key, key_ptr); s &= 3; @@ -178,12 +178,13 @@ static void decode_block(uint8_t *src, uint8_t *dest, unsigned size, } } -static uint32_t get_v(uint8_t *p) +static uint32_t get_v(uint8_t *p, int len) { uint32_t v = 0; + const uint8_t *end = p + len; do { - if (v >= UINT_MAX / 128 - *p) + if (p >= end || v >= UINT_MAX / 128 - *p) return v; v <<= 7; v += *p & 0x7f; @@ -204,8 +205,8 @@ static uint8_t *read_vblock(AVIOContext *src, uint32_t *size, decode_block(tmp, tmp, 4, key, k2, align); - n = get_v(tmp); - if (!n) + n = get_v(tmp, 4); + if (n < 4) return NULL; buf = av_malloc(n); @@ -218,7 +219,7 @@ static uint8_t *read_vblock(AVIOContext *src, uint32_t *size, memcpy(buf, tmp, 4); if (avio_read(src, buf + 4, n) == n) { - decode_block(buf + 4, buf + 4, n, key, k2, align + 4); + decode_block(buf + 4, buf + 4, n, key, k2, align); } else { av_free(buf); buf = NULL; @@ -241,18 +242,21 @@ static uint8_t *read_sb_block(AVIOContext *src, unsigned *size, k2 = *key; decode_block(ibuf, sbuf, 8, *key, &k2, 0); - n = get_v(sbuf+2); + n = get_v(sbuf+2, 6); if (sbuf[0] != 'S' || sbuf[1] != 'B' || (expected_size>0 && n != expected_size)) { uint32_t tmpkey = recover_key(ibuf, expected_size); k2 = tmpkey; decode_block(ibuf, sbuf, 8, tmpkey, &k2, 0); - n = get_v(sbuf+2); + n = get_v(sbuf+2, 6); if (sbuf[0] != 'S' || sbuf[1] != 'B' || expected_size != n) return NULL; *key = tmpkey; } + if (n < 8) + return NULL; + buf = av_malloc(n); if (!buf) return NULL; @@ -272,17 +276,15 @@ static uint8_t *read_sb_block(AVIOContext *src, unsigned *size, return buf; } -static void track_header(VividasDemuxContext *viv, AVFormatContext *s, uint8_t *buf, int size) +static int track_header(VividasDemuxContext *viv, AVFormatContext *s, uint8_t *buf, int size) { - int i,j; + int i, j, ret; int64_t off; int val_1; - int num_video, num_audio; - AVIOContext *pb; + int num_video; + AVIOContext pb0, *pb = &pb0; - pb = avio_alloc_context(buf, size, 0, NULL, NULL, NULL, NULL); - if (!pb) - return; + ffio_init_context(pb, buf, size, 0, NULL, NULL, NULL, NULL); ffio_read_varlen(pb); // track_header_len avio_r8(pb); // '1' @@ -292,6 +294,8 @@ static void track_header(VividasDemuxContext *viv, AVFormatContext *s, uint8_t for (i=0;iid = i; @@ -335,15 +343,17 @@ static void track_header(VividasDemuxContext *viv, AVFormatContext *s, uint8_t off = avio_tell(pb); off += ffio_read_varlen(pb); // val_10 avio_r8(pb); // '4' - num_audio = avio_r8(pb); + viv->num_audio = avio_r8(pb); avio_seek(pb, off, SEEK_SET); - if (num_audio != 1) - av_log(s, AV_LOG_WARNING, "number of audio tracks %d is not 1\n", num_audio); + if (viv->num_audio != 1) + av_log(s, AV_LOG_WARNING, "number of audio tracks %d is not 1\n", viv->num_audio); - for(i=0;inum_audio;i++) { int q; AVStream *st = avformat_new_stream(s, NULL); + if (!st) + return AVERROR(ENOMEM); st->id = num_video + i; @@ -373,22 +383,36 @@ static void track_header(VividasDemuxContext *viv, AVFormatContext *s, uint8_t ffio_read_varlen(pb); // len_3 num_data = avio_r8(pb); for (j = 0; j < num_data; j++) { - data_len[j] = ffio_read_varlen(pb); - xd_size += data_len[j]; + uint64_t len = ffio_read_varlen(pb); + if (len > INT_MAX/2 - xd_size) { + return AVERROR_INVALIDDATA; + } + data_len[j] = len; + xd_size += len; } - st->codecpar->extradata_size = 64 + xd_size + xd_size / 255; - if (ff_alloc_extradata(st->codecpar, st->codecpar->extradata_size)) - return; + ret = ff_alloc_extradata(st->codecpar, 64 + xd_size + xd_size / 255); + if (ret < 0) + return ret; p = st->codecpar->extradata; p[0] = 2; - for (j = 0; j < num_data - 1; j++) - offset += av_xiphlacing(&p[offset], data_len[j]); + for (j = 0; j < num_data - 1; j++) { + unsigned delta = av_xiphlacing(&p[offset], data_len[j]); + if (delta > data_len[j]) { + return AVERROR_INVALIDDATA; + } + offset += delta; + } for (j = 0; j < num_data; j++) { - avio_read(pb, &p[offset], data_len[j]); + int ret = avio_read(pb, &p[offset], data_len[j]); + if (ret < data_len[j]) { + st->codecpar->extradata_size = 0; + av_freep(&st->codecpar->extradata); + break; + } offset += data_len[j]; } @@ -397,51 +421,64 @@ static void track_header(VividasDemuxContext *viv, AVFormatContext *s, uint8_t } } - av_free(pb); + return 0; } -static void track_index(VividasDemuxContext *viv, AVFormatContext *s, uint8_t *buf, unsigned size) +static int track_index(VividasDemuxContext *viv, AVFormatContext *s, uint8_t *buf, unsigned size) { int64_t off; int64_t poff; int maxnp=0; - AVIOContext *pb; + AVIOContext pb0, *pb = &pb0; int i; + int64_t filesize = avio_size(s->pb); - pb = avio_alloc_context(buf, size, 0, NULL, NULL, NULL, NULL); - if (!pb) - return; + ffio_init_context(pb, buf, size, 0, NULL, NULL, NULL, NULL); ffio_read_varlen(pb); // track_index_len avio_r8(pb); // 'c' viv->n_sb_blocks = ffio_read_varlen(pb); + if (viv->n_sb_blocks < 0 || viv->n_sb_blocks > size / 2) + goto error; viv->sb_blocks = av_calloc(viv->n_sb_blocks, sizeof(VIV_SB_block)); if (!viv->sb_blocks) { viv->n_sb_blocks = 0; - av_free(pb); - return; + return AVERROR(ENOMEM); } off = 0; poff = 0; for (i = 0; i < viv->n_sb_blocks; i++) { + uint64_t size_tmp = ffio_read_varlen(pb); + uint64_t n_packets_tmp = ffio_read_varlen(pb); + + if (size_tmp > INT_MAX || n_packets_tmp > INT_MAX) + goto error; + viv->sb_blocks[i].byte_offset = off; viv->sb_blocks[i].packet_offset = poff; - viv->sb_blocks[i].size = ffio_read_varlen(pb); - viv->sb_blocks[i].n_packets = ffio_read_varlen(pb); + viv->sb_blocks[i].size = size_tmp; + viv->sb_blocks[i].n_packets = n_packets_tmp; off += viv->sb_blocks[i].size; poff += viv->sb_blocks[i].n_packets; - if (maxnp < viv->sb_blocks[i].n_packets) maxnp = viv->sb_blocks[i].n_packets; } + if (filesize > 0 && poff > filesize) + goto error; + viv->sb_entries = av_calloc(maxnp, sizeof(VIV_SB_entry)); - av_free(pb); + + return 0; +error: + viv->n_sb_blocks = 0; + av_freep(&viv->sb_blocks); + return AVERROR_INVALIDDATA; } static void load_sb_block(AVFormatContext *s, VividasDemuxContext *viv, unsigned expected_size) @@ -500,6 +537,7 @@ static int viv_read_header(AVFormatContext *s) uint32_t b22_size = 0; uint32_t b22_key = 0; uint8_t *buf = 0; + int ret; avio_skip(pb, 9); @@ -531,6 +569,9 @@ static int viv_read_header(AVFormatContext *s) break; block_len = ffio_read_varlen(pb); + if (avio_feof(pb) || block_len <= 0) + return AVERROR_INVALIDDATA; + block_type = avio_r8(pb); if (block_type == 22) { @@ -555,14 +596,18 @@ static int viv_read_header(AVFormatContext *s) buf = read_vblock(pb, &v, key, &k2, 0); if (!buf) return AVERROR(EIO); - track_header(viv, s, buf, v); + ret = track_header(viv, s, buf, v); av_free(buf); + if (ret < 0) + return ret; buf = read_vblock(pb, &v, key, &k2, v); if (!buf) return AVERROR(EIO); - track_index(viv, s, buf, v); + ret = track_index(viv, s, buf, v); av_free(buf); + if (ret < 0) + return ret; viv->sb_offset = avio_tell(pb); if (viv->n_sb_blocks > 0) { @@ -626,6 +671,9 @@ static int viv_read_packet(AVFormatContext *s, if (viv->sb_entries[viv->current_sb_entry].flag == 0) { uint64_t v_size = ffio_read_varlen(pb); + if (!viv->num_audio) + return AVERROR_INVALIDDATA; + ffio_read_varlen(pb); if (v_size > INT_MAX) return AVERROR_INVALIDDATA;