RepoMirrors/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2024-12-18 21:45:10 +00:00
Code Issues Projects Releases Wiki Activity

latmenc: error out when packet size is too large.

Browse Source 
Previously it would just silently write out incorrect data.
This also fixes a potential integer overflow in the allocation.

Signed-off-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>
This commit is contained in:
Reimar Döffinger 2012-04-10 21:11:50 +02:00
parent a736eb4a60
commit 8e357e8e75
1 changed files with 11 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
libavformat/latmenc.c
View File

@ -138,7 +138,7 @@ static int latm_write_packet(AVFormatContext *s, AVPacket *pkt)
PutBitContext bs; PutBitContext bs;
int i, len; int i, len;
uint8_t loas_header[] = "\x56\xe0\x00"; uint8_t loas_header[] = "\x56\xe0\x00";
uint8_t *buf; uint8_t *buf = NULL;
if (s->streams[0]->codec->codec_id == CODEC_ID_AAC_LATM) if (s->streams[0]->codec->codec_id == CODEC_ID_AAC_LATM)
return ff_raw_write_packet(s, pkt); return ff_raw_write_packet(s, pkt);
@ -147,6 +147,8 @@ static int latm_write_packet(AVFormatContext *s, AVPacket *pkt)
av_log(s, AV_LOG_ERROR, "ADTS header detected - ADTS will not be incorrectly muxed into LATM\n"); av_log(s, AV_LOG_ERROR, "ADTS header detected - ADTS will not be incorrectly muxed into LATM\n");
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
} }
if (pkt->size > 0x1fff)
goto too_large;
buf = av_malloc(pkt->size+1024); buf = av_malloc(pkt->size+1024);
if (!buf) if (!buf)
@ -173,6 +175,9 @@ static int latm_write_packet(AVFormatContext *s, AVPacket *pkt)
len = put_bits_count(&bs) >> 3; len = put_bits_count(&bs) >> 3;
if (len > 0x1fff)
goto too_large;
loas_header[1] |= (len >> 8) & 0x1f; loas_header[1] |= (len >> 8) & 0x1f;
loas_header[2] |= len & 0xff; loas_header[2] |= len & 0xff;
@ -182,6 +187,11 @@ static int latm_write_packet(AVFormatContext *s, AVPacket *pkt)
av_free(buf); av_free(buf);
return 0; return 0;
too_large:
av_log(s, AV_LOG_ERROR, "LATM packet size larger than maximum size 0x1fff\n");
av_free(buf);
return AVERROR_INVALIDDATA;
} }
AVOutputFormat ff_latm_muxer = { AVOutputFormat ff_latm_muxer = {