MrBesen/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

avformat/tta: fix crash with corrupted files

Browse Source 
av_add_index_entry() can fail, for example because the parameters are
invalid, or because memory allocation fails. Check this; it can actually
happen with corrupted files.

The second hunk is just for robustness. Just in case functions like
ff_reduce_index() remove entries. (Not sure if this can actually
happen.)

Fixes ticket #4294.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
wm4 2015-02-03 14:41:10 +01:00 committed by Michael Niedermayer
parent 22504396fe
commit 6a0cd529a3
1 changed files with 9 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
libavformat/tta.c
View File

@ -118,8 +118,10 @@ static int tta_read_header(AVFormatContext *s)
ffio_init_checksum(s->pb, tta_check_crc, UINT32_MAX);
for (i = 0; i < c->totalframes; i++) {
uint32_t size = avio_rl32(s->pb);
av_add_index_entry(st, framepos, i * c->frame_size, size, 0,
AVINDEX_KEYFRAME);
int r;
if ((r = av_add_index_entry(st, framepos, i * c->frame_size, size, 0,
AVINDEX_KEYFRAME)) < 0)
return r;
framepos += size;
}
crc = ffio_get_checksum(s->pb) ^ UINT32_MAX;
@ -153,6 +155,11 @@ static int tta_read_packet(AVFormatContext *s, AVPacket *pkt)
if (c->currentframe >= c->totalframes)
return AVERROR_EOF;
if (st->nb_index_entries < c->totalframes) {
av_log(s, AV_LOG_ERROR, "Index entry disappeared\n");
return AVERROR_INVALIDDATA;
}
size = st->index_entries[c->currentframe].size;
ret = av_get_packet(s->pb, pkt, size);