RepoMirrors/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2025-02-17 04:17:05 +00:00
Code Issues Projects Releases Wiki Activity

ffm: reject invalid codec_id and codec_type

Browse Source 
A negative codec_id cannot be handled by the found_decoder API of
AVStream->info: if the codec_id is not recognized, found_decoder is set
to -codec_id, which has to be '<0' according to the API documentation.

This can cause NULL pointer dereferencing in try_decode_frame.

Also make sure the codec_type matches the expected one for codec_id.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit ecf63b7cc2)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
This commit is contained in:
Andreas Cadhalpun 2015-12-14 22:11:55 +01:00
parent 7f33fef2a2
commit 6fc3f6f43b
1 changed files with 28 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
libavformat/ffmdec.c
View File

@ -243,6 +243,7 @@ static int ffm2_read_header(AVFormatContext *s)
AVStream *st;
AVIOContext *pb = s->pb;
AVCodecContext *codec;
const AVCodecDescriptor *codec_desc;
int ret;
ffm->packet_size = avio_rb32(pb);
@ -289,7 +290,20 @@ static int ffm2_read_header(AVFormatContext *s)
codec = st->codec;
/* generic info */
codec->codec_id = avio_rb32(pb);
codec_desc = avcodec_descriptor_get(codec->codec_id);
if (!codec_desc) {
av_log(s, AV_LOG_ERROR, "Invalid codec id: %d\n", codec->codec_id);
codec->codec_id = AV_CODEC_ID_NONE;
goto fail;
}
codec->codec_type = avio_r8(pb);
if (codec->codec_type != codec_desc->type) {
av_log(s, AV_LOG_ERROR, "Codec type mismatch: expected %d, found %d\n",
codec_desc->type, codec->codec_type);
codec->codec_id = AV_CODEC_ID_NONE;
codec->codec_type = AVMEDIA_TYPE_UNKNOWN;
goto fail;
}
codec->bit_rate = avio_rb32(pb);
codec->flags = avio_rb32(pb);
codec->flags2 = avio_rb32(pb);
@ -389,6 +403,7 @@ static int ffm_read_header(AVFormatContext *s)
AVStream *st;
AVIOContext *pb = s->pb;
AVCodecContext *codec;
const AVCodecDescriptor *codec_desc;
int i, nb_streams;
uint32_t tag;
@ -426,7 +441,20 @@ static int ffm_read_header(AVFormatContext *s)
codec = st->codec;
/* generic info */
codec->codec_id = avio_rb32(pb);
codec_desc = avcodec_descriptor_get(codec->codec_id);
if (!codec_desc) {
av_log(s, AV_LOG_ERROR, "Invalid codec id: %d\n", codec->codec_id);
codec->codec_id = AV_CODEC_ID_NONE;
goto fail;
}
codec->codec_type = avio_r8(pb); /* codec_type */
if (codec->codec_type != codec_desc->type) {
av_log(s, AV_LOG_ERROR, "Codec type mismatch: expected %d, found %d\n",
codec_desc->type, codec->codec_type);
codec->codec_id = AV_CODEC_ID_NONE;
codec->codec_type = AVMEDIA_TYPE_UNKNOWN;
goto fail;
}
codec->bit_rate = avio_rb32(pb);
codec->flags = avio_rb32(pb);
codec->flags2 = avio_rb32(pb);