RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

ffm: reject invalid codec_id and codec_type 

A negative codec_id cannot be handled by the found_decoder API of
AVStream->info: if the codec_id is not recognized, found_decoder is set
to -codec_id, which has to be '<0' according to the API documentation.

This can cause NULL pointer dereferencing in try_decode_frame.

Also make sure the codec_type matches the expected one for codec_id.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
This commit is contained in:
Andreas Cadhalpun 2015-12-14 22:11:55 +01:00
parent 09d84e00bd
commit ecf63b7cc2
1 changed files with 28 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
libavformat/ffmdec.c
View File

@ -276,6 +276,7 @@ static int ffm2_read_header(AVFormatContext *s)
AVStream *st; AVStream *st;
AVIOContext *pb = s->pb; AVIOContext *pb = s->pb;
AVCodecContext *codec; AVCodecContext *codec;
const AVCodecDescriptor *codec_desc;
int ret; int ret;
int f_main = 0, f_cprv = -1, f_stvi = -1, f_stau = -1; int f_main = 0, f_cprv = -1, f_stvi = -1, f_stau = -1;
AVCodec *enc; AVCodec *enc;
@ -330,7 +331,20 @@ static int ffm2_read_header(AVFormatContext *s)
codec = st->codec; codec = st->codec;
/* generic info */ /* generic info */
codec->codec_id = avio_rb32(pb); codec->codec_id = avio_rb32(pb);
codec_desc = avcodec_descriptor_get(codec->codec_id);
if (!codec_desc) {
av_log(s, AV_LOG_ERROR, "Invalid codec id: %d\n", codec->codec_id);
codec->codec_id = AV_CODEC_ID_NONE;
goto fail;
}
codec->codec_type = avio_r8(pb); codec->codec_type = avio_r8(pb);
if (codec->codec_type != codec_desc->type) {
av_log(s, AV_LOG_ERROR, "Codec type mismatch: expected %d, found %d\n",
codec_desc->type, codec->codec_type);
codec->codec_id = AV_CODEC_ID_NONE;
codec->codec_type = AVMEDIA_TYPE_UNKNOWN;
goto fail;
}
codec->bit_rate = avio_rb32(pb); codec->bit_rate = avio_rb32(pb);
codec->flags = avio_rb32(pb); codec->flags = avio_rb32(pb);
codec->flags2 = avio_rb32(pb); codec->flags2 = avio_rb32(pb);
@ -479,6 +493,7 @@ static int ffm_read_header(AVFormatContext *s)
AVStream *st; AVStream *st;
AVIOContext *pb = s->pb; AVIOContext *pb = s->pb;
AVCodecContext *codec; AVCodecContext *codec;
const AVCodecDescriptor *codec_desc;
int i, nb_streams; int i, nb_streams;
uint32_t tag; uint32_t tag;
@ -516,7 +531,20 @@ static int ffm_read_header(AVFormatContext *s)
codec = st->codec; codec = st->codec;
/* generic info */ /* generic info */
codec->codec_id = avio_rb32(pb); codec->codec_id = avio_rb32(pb);
codec_desc = avcodec_descriptor_get(codec->codec_id);
if (!codec_desc) {
av_log(s, AV_LOG_ERROR, "Invalid codec id: %d\n", codec->codec_id);
codec->codec_id = AV_CODEC_ID_NONE;
goto fail;
}
codec->codec_type = avio_r8(pb); /* codec_type */ codec->codec_type = avio_r8(pb); /* codec_type */
if (codec->codec_type != codec_desc->type) {
av_log(s, AV_LOG_ERROR, "Codec type mismatch: expected %d, found %d\n",
codec_desc->type, codec->codec_type);
codec->codec_id = AV_CODEC_ID_NONE;
codec->codec_type = AVMEDIA_TYPE_UNKNOWN;
goto fail;
}
codec->bit_rate = avio_rb32(pb); codec->bit_rate = avio_rb32(pb);
codec->flags = avio_rb32(pb); codec->flags = avio_rb32(pb);
codec->flags2 = avio_rb32(pb); codec->flags2 = avio_rb32(pb);