PR #25019 opened by James Almer (jamrial) URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25019 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25019.patch
Cosmetic change. >From 25772a4793a94a340cc76a1a654a4767068b374e Mon Sep 17 00:00:00 2001 From: James Almer <[email protected]> Date: Sun, 11 Oct 2026 21:06:54 -0300 Subject: [PATCH] avformat/mov: split off ipco and ipma box parsing to their own functions Signed-off-by: James Almer <[email protected]> --- libavformat/isom.h | 7 +++ libavformat/mov.c | 154 ++++++++++++++++++++++++--------------------- 2 files changed, 91 insertions(+), 70 deletions(-) diff --git a/libavformat/isom.h b/libavformat/isom.h index 5474d700d6..ac7717391a 100644 --- a/libavformat/isom.h +++ b/libavformat/isom.h @@ -34,6 +34,7 @@ #include "libavutil/stereo3d.h" #include "avio.h" +#include "avio_internal.h" #include "internal.h" #include "dv.h" @@ -102,6 +103,12 @@ typedef struct MOVAtom { int64_t size; /* total size (excluding the size and type fields) */ } MOVAtom; +typedef struct MOVAtoms { + MOVAtom a; + FFIOContext b; + uint8_t *data; +} MOVAtoms; + struct MOVParseTableEntry; typedef struct MOVFragment { diff --git a/libavformat/mov.c b/libavformat/mov.c index 85e28f45f8..8651a0e3d3 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -9918,83 +9918,58 @@ static int mov_read_imir(MOVContext *c, AVIOContext *pb, MOVAtom atom) return 0; } -static int mov_read_iprp(MOVContext *c, AVIOContext *pb, MOVAtom atom) +static int mov_read_ipco(MOVContext *c, AVIOContext *pb, MOVAtom atom, + MOVAtoms **atoms, int *nb_atoms) { - typedef struct MOVAtoms { - FFIOContext b; - uint32_t type; - int64_t size; - uint8_t *data; - } MOVAtoms; - MOVAtoms *atoms = NULL; - MOVAtom a; - unsigned count; - int nb_atoms = 0; - int version, flags; - int ret; + while (atom.size >= 8) { + MOVAtoms *ref = av_dynarray2_add((void**)atoms, nb_atoms, sizeof(MOVAtoms), NULL); + if (!ref) + return AVERROR(ENOMEM); - a.size = avio_rb32(pb); - a.type = avio_rl32(pb); + ref->data = NULL; + ref->a.size = avio_rb32(pb); + ref->a.type = avio_rl32(pb); + if (ref->a.size > atom.size || ref->a.size < 8) + break; + ref->data = av_malloc(ref->a.size); + if (!ref->data) + return AVERROR_INVALIDDATA; - if (a.size < 8 || a.size > atom.size || a.type != MKTAG('i','p','c','o')) + av_log(c->fc, AV_LOG_TRACE, "ipco: index %d, box type %s\n", *nb_atoms, + av_fourcc2str(ref->a.type)); + AV_WB32(ref->data, ref->a.size); + AV_WL32(ref->data + 4, ref->a.type); + if (avio_read(pb, ref->data + 8, ref->a.size - 8) != ref->a.size - 8) + return AVERROR_INVALIDDATA; + ffio_init_read_context(&ref->b, ref->data, ref->a.size); + atom.size -= ref->a.size; + } + + if (atom.size) return AVERROR_INVALIDDATA; - atom.size -= a.size; - a.size -= 8; - while (a.size >= 8) { - MOVAtoms *ref = av_dynarray2_add((void**)&atoms, &nb_atoms, sizeof(MOVAtoms), NULL); - if (!ref) { - ret = AVERROR(ENOMEM); - goto fail; - } - ref->data = NULL; - ref->size = avio_rb32(pb); - ref->type = avio_rl32(pb); - if (ref->size > a.size || ref->size < 8) - break; - ref->data = av_malloc(ref->size); - if (!ref->data) { - ret = AVERROR_INVALIDDATA; - goto fail; - } - av_log(c->fc, AV_LOG_TRACE, "ipco: index %d, box type %s\n", nb_atoms, av_fourcc2str(ref->type)); - AV_WB32(ref->data, ref->size); - AV_WL32(ref->data + 4, ref->type); - if (avio_read(pb, ref->data + 8, ref->size - 8) != ref->size - 8) { - ret = AVERROR_INVALIDDATA; - goto fail; - } - ffio_init_read_context(&ref->b, ref->data, ref->size); - a.size -= ref->size; - } + return 0; +} - if (a.size) { - ret = AVERROR_INVALIDDATA; - goto fail; - } - - a.size = avio_rb32(pb); - a.type = avio_rl32(pb); - - if (a.size < 16 || a.size > atom.size || a.type != MKTAG('i','p','m','a')) { - ret = AVERROR_INVALIDDATA; - goto fail; - } +static int mov_read_ipma(MOVContext *c, AVIOContext *pb, MOVAtom atom, + MOVAtoms *atoms, int nb_atoms) +{ + unsigned count; + int version, flags; + int ret; version = avio_r8(pb); flags = avio_rb24(pb); count = avio_rb32(pb); - a.size -= 16; + atom.size -= 8; for (int i = 0; i < count; i++) { int item_id = version ? avio_rb32(pb) : avio_rb16(pb); int assoc_count = avio_r8(pb); - a.size -= (version ? 5 : 3) + assoc_count * (1 + (flags & 1)); - if (avio_feof(pb) || a.size < 0) { - ret = AVERROR_INVALIDDATA; - goto fail; - } + atom.size -= (version ? 5 : 3) + assoc_count * (1 + (flags & 1)); + if (avio_feof(pb) || atom.size < 0) + return AVERROR_INVALIDDATA; for (int j = 0; j < assoc_count; j++) { MOVAtoms *ref; @@ -10005,26 +9980,65 @@ static int mov_read_iprp(MOVContext *c, AVIOContext *pb, MOVAtom atom) } if (!index) continue; - if (index > nb_atoms) { - ret = AVERROR_INVALIDDATA; - goto fail; - } + if (index > nb_atoms) + return AVERROR_INVALIDDATA; + ref = &atoms[--index]; av_log(c->fc, AV_LOG_TRACE, "ipma: property_index %d, item_id %d, item_type %s\n", - index + 1, item_id, av_fourcc2str(ref->type)); + index + 1, item_id, av_fourcc2str(ref->a.type)); c->cur_item_id = item_id; ret = mov_read_default(c, &ref->b.pub, - (MOVAtom) { .size = ref->size, + (MOVAtom) { .size = ref->a.size, .type = MKTAG('i','p','c','o') }); if (ret < 0) - goto fail; - ffio_init_read_context(&ref->b, ref->data, ref->size); + return ret; + ffio_init_read_context(&ref->b, ref->data, ref->a.size); } } + if (atom.size) + return AVERROR_INVALIDDATA; + + return 0; +} + +static int mov_read_iprp(MOVContext *c, AVIOContext *pb, MOVAtom atom) +{ + MOVAtoms *atoms = NULL; + MOVAtom a; + int nb_atoms = 0; + int ret; + + a.size = avio_rb32(pb); + a.type = avio_rl32(pb); + + if (a.size <= 8 || a.size > atom.size || a.type != MKTAG('i','p','c','o')) + return AVERROR_INVALIDDATA; + + atom.size -= a.size; + a.size -= 8; + + ret = mov_read_ipco(c, pb, a, &atoms, &nb_atoms); + if (ret < 0) + goto fail; + + a.size = avio_rb32(pb); + a.type = avio_rl32(pb); + + if (a.size <= 8 || a.size > atom.size || a.type != MKTAG('i','p','m','a')) { + ret = AVERROR_INVALIDDATA; + goto fail; + } + + a.size -= 8; + + ret = mov_read_ipma(c, pb, a, atoms, nb_atoms); + if (ret < 0) + goto fail; + ret = 0; fail: c->cur_item_id = -1; -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
