From f7bf59b431e0921d5f318154f64c78bb226e33b9 Mon Sep 17 00:00:00 2001 From: Andreas Rheinhardt Date: Tue, 3 Dec 2019 18:09:03 +0100 Subject: [PATCH] avformat/matroskadec: Check before allocations That way one doesn't have to free later. In this case (concerning TTA extradata), this also fixes a memleak when the output samplerate is invalid. Signed-off-by: Andreas Rheinhardt Signed-off-by: James Almer --- libavformat/matroskadec.c | 27 +++++++++++++-------------- 1 file changed, 13 insertions(+), 14 deletions(-) diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c index bd6f08575b..3ce1d399e9 100644 --- a/libavformat/matroskadec.c +++ b/libavformat/matroskadec.c @@ -2545,6 +2545,19 @@ static int matroska_parse_tracks(AVFormatContext *s) memcpy(&extradata[12], track->codec_priv.data, track->codec_priv.size); } else if (codec_id == AV_CODEC_ID_TTA) { + if (track->audio.channels > UINT16_MAX || + track->audio.bitdepth > UINT16_MAX) { + av_log(matroska->ctx, AV_LOG_WARNING, + "Too large audio channel number %"PRIu64 + " or bitdepth %"PRIu64". Skipping track.\n", + track->audio.channels, track->audio.bitdepth); + if (matroska->ctx->error_recognition & AV_EF_EXPLODE) + return AVERROR_INVALIDDATA; + else + continue; + } + if (track->audio.out_samplerate < 0 || track->audio.out_samplerate > INT_MAX) + return AVERROR_INVALIDDATA; extradata_size = 30; extradata = av_mallocz(extradata_size + AV_INPUT_BUFFER_PADDING_SIZE); if (!extradata) @@ -2553,22 +2566,8 @@ static int matroska_parse_tracks(AVFormatContext *s) NULL, NULL, NULL, NULL); avio_write(&b, "TTA1", 4); avio_wl16(&b, 1); - if (track->audio.channels > UINT16_MAX || - track->audio.bitdepth > UINT16_MAX) { - av_log(matroska->ctx, AV_LOG_WARNING, - "Too large audio channel number %"PRIu64 - " or bitdepth %"PRIu64". Skipping track.\n", - track->audio.channels, track->audio.bitdepth); - av_freep(&extradata); - if (matroska->ctx->error_recognition & AV_EF_EXPLODE) - return AVERROR_INVALIDDATA; - else - continue; - } avio_wl16(&b, track->audio.channels); avio_wl16(&b, track->audio.bitdepth); - if (track->audio.out_samplerate < 0 || track->audio.out_samplerate > INT_MAX) - return AVERROR_INVALIDDATA; avio_wl32(&b, track->audio.out_samplerate); avio_wl32(&b, av_rescale((matroska->duration * matroska->time_scale), track->audio.out_samplerate,