RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Merge commit '8d617b11cfc87b2c6056fee029ac5bc760af874a' 

* commit '8d617b11cfc87b2c6056fee029ac5bc760af874a':
  id3v2: pad the APIC packets as required by lavc.
  dfa: check for invalid access in decode_wdlt().

Conflicts:
	libavformat/id3v2.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2013-04-04 13:41:01 +02:00
parent ab2989378f 8d617b11cf
commit cdafcf838c
2 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
libavcodec/dfa.c
View File

@ -261,6 +261,8 @@ static int decode_wdlt(GetByteContext *gb, uint8_t *frame, int width, int height
segments = bytestream2_get_le16(gb); segments = bytestream2_get_le16(gb);
} }
line_ptr = frame; line_ptr = frame;
if (frame_end - frame < width)
return AVERROR_INVALIDDATA;
frame += width; frame += width;
y++; y++;
while (segments--) { while (segments--) {

4
libavformat/id3v2.c
View File

@ -490,9 +490,9 @@ static void read_apic(AVFormatContext *s, AVIOContext *pb, int taglen, char *tag
} }
apic->buf = av_buffer_alloc(taglen + FF_INPUT_BUFFER_PADDING_SIZE); apic->buf = av_buffer_alloc(taglen + FF_INPUT_BUFFER_PADDING_SIZE);
apic->buf->size -= FF_INPUT_BUFFER_PADDING_SIZE;
if (!apic->buf || !taglen || avio_read(pb, apic->buf->data, taglen) != taglen) if (!apic->buf || !taglen || avio_read(pb, apic->buf->data, taglen) != taglen)
goto fail; goto fail;
memset(apic->buf->data + taglen, 0, FF_INPUT_BUFFER_PADDING_SIZE);
new_extra->tag = "APIC"; new_extra->tag = "APIC";
new_extra->data = apic; new_extra->data = apic;
@ -848,7 +848,7 @@ int ff_id3v2_parse_apic(AVFormatContext *s, ID3v2ExtraMeta **extra_meta)
av_init_packet(&st->attached_pic); av_init_packet(&st->attached_pic);
st->attached_pic.buf = apic->buf; st->attached_pic.buf = apic->buf;
st->attached_pic.data = apic->buf->data; st->attached_pic.data = apic->buf->data;
st->attached_pic.size = apic->buf->size; st->attached_pic.size = apic->buf->size - FF_INPUT_BUFFER_PADDING_SIZE;
st->attached_pic.stream_index = st->index; st->attached_pic.stream_index = st->index;
st->attached_pic.flags |= AV_PKT_FLAG_KEY; st->attached_pic.flags |= AV_PKT_FLAG_KEY;