RepoMirrors/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2024-12-27 01:42:20 +00:00
Code Issues Projects Releases Wiki Activity

avformat/mxfdec: store next_klv in KLVPacket

Browse Source 
Signed-off-by: Marton Balint <cus@passwd.hu>
This commit is contained in:
Marton Balint 2018-05-20 17:17:42 +02:00
parent d4d29052c3
commit bfa0b50441
2 changed files with 9 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
libavformat/mxf.h
View File

@ -62,6 +62,7 @@ typedef struct KLVPacket {
UID key; UID key;
int64_t offset; int64_t offset;
uint64_t length; uint64_t length;
int64_t next_klv;
} KLVPacket; } KLVPacket;
typedef struct MXFCodecUL { typedef struct MXFCodecUL {

13
libavformat/mxfdec.c
View File

@ -392,7 +392,7 @@ static int mxf_read_sync(AVIOContext *pb, const uint8_t *key, unsigned size)
static int klv_read_packet(KLVPacket *klv, AVIOContext *pb) static int klv_read_packet(KLVPacket *klv, AVIOContext *pb)
{ {
int64_t length; int64_t length, pos;
if (!mxf_read_sync(pb, mxf_klv_key, 4)) if (!mxf_read_sync(pb, mxf_klv_key, 4))
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
klv->offset = avio_tell(pb) - 4; klv->offset = avio_tell(pb) - 4;
@ -402,6 +402,10 @@ static int klv_read_packet(KLVPacket *klv, AVIOContext *pb)
if (length < 0) if (length < 0)
return length; return length;
klv->length = length; klv->length = length;
pos = avio_tell(pb);
if (pos > INT64_MAX - length)
return AVERROR_INVALIDDATA;
klv->next_klv = pos + length;
return 0; return 0;
} }
@ -3264,7 +3268,7 @@ static int mxf_read_packet_old(AVFormatContext *s, AVPacket *pkt)
IS_KLV_KEY(klv.key, mxf_avid_essence_element_key)) { IS_KLV_KEY(klv.key, mxf_avid_essence_element_key)) {
int body_sid = find_body_sid_by_offset(mxf, klv.offset); int body_sid = find_body_sid_by_offset(mxf, klv.offset);
int index = mxf_get_stream_index(s, &klv, body_sid); int index = mxf_get_stream_index(s, &klv, body_sid);
int64_t next_ofs, next_klv; int64_t next_ofs;
AVStream *st; AVStream *st;
if (index < 0) { if (index < 0) {
@ -3279,10 +3283,9 @@ static int mxf_read_packet_old(AVFormatContext *s, AVPacket *pkt)
if (s->streams[index]->discard == AVDISCARD_ALL) if (s->streams[index]->discard == AVDISCARD_ALL)
goto skip; goto skip;
next_klv = avio_tell(s->pb) + klv.length;
next_ofs = mxf_set_current_edit_unit(mxf, klv.offset); next_ofs = mxf_set_current_edit_unit(mxf, klv.offset);
if (next_ofs >= 0 && next_klv > next_ofs) { if (next_ofs >= 0 && klv.next_klv > next_ofs) {
/* if this check is hit then it's possible OPAtom was treated as OP1a /* if this check is hit then it's possible OPAtom was treated as OP1a
* truncate the packet since it's probably very large (>2 GiB is common) */ * truncate the packet since it's probably very large (>2 GiB is common) */
avpriv_request_sample(s, avpriv_request_sample(s,
@ -3314,7 +3317,7 @@ static int mxf_read_packet_old(AVFormatContext *s, AVPacket *pkt)
return ret; return ret;
/* seek for truncated packets */ /* seek for truncated packets */
avio_seek(s->pb, next_klv, SEEK_SET); avio_seek(s->pb, klv.next_klv, SEEK_SET);
return 0; return 0;
} else } else