Avoids trying to read a packet with 0 or negative size.
Avoids a potential infinite loop due to seeking backwards.
---
libavformat/swfdec.c | 22 +++++++++++++++++++---
1 files changed, 19 insertions(+), 3 deletions(-)
diff --git a/libavformat/swfdec.c b/libavformat/swfdec.c
index f105c14..d8a9852 100644
--- a/libavformat/swfdec.c
+++ b/libavformat/swfdec.c
@@ -100,6 +100,10 @@ static int swf_read_packet(AVFormatContext *s, AVPacket
*pkt)
tag = get_swf_tag(pb, &len);
if (tag < 0)
return AVERROR(EIO);
+ if (len < 0) {
+ av_log(s, AV_LOG_ERROR, "invalid tag length: %d\n", len);
+ return AVERROR_INVALIDDATA;
+ }
if (tag == TAG_VIDEOSTREAM) {
int ch_id = avio_rl16(pb);
len -= 2;
@@ -161,7 +165,10 @@ static int swf_read_packet(AVFormatContext *s, AVPacket
*pkt)
st = s->streams[i];
if (st->codec->codec_type == AVMEDIA_TYPE_VIDEO && st->id ==
ch_id) {
frame = avio_rl16(pb);
- if ((res = av_get_packet(pb, pkt, len-2)) < 0)
+ len -= 2;
+ if (len <= 0)
+ goto skip;
+ if ((res = av_get_packet(pb, pkt, len)) < 0)
return res;
pkt->pos = pos;
pkt->pts = frame;
@@ -175,9 +182,14 @@ static int swf_read_packet(AVFormatContext *s, AVPacket
*pkt)
if (st->codec->codec_type == AVMEDIA_TYPE_AUDIO && st->id ==
-1) {
if (st->codec->codec_id == AV_CODEC_ID_MP3) {
avio_skip(pb, 4);
- if ((res = av_get_packet(pb, pkt, len-4)) < 0)
+ len -= 4;
+ if (len <= 0)
+ goto skip;
+ if ((res = av_get_packet(pb, pkt, len)) < 0)
return res;
} else { // ADPCM, PCM
+ if (len <= 0)
+ goto skip;
if ((res = av_get_packet(pb, pkt, len)) < 0)
return res;
}
@@ -203,7 +215,10 @@ static int swf_read_packet(AVFormatContext *s, AVPacket
*pkt)
st = vst;
}
avio_rl16(pb); /* BITMAP_ID */
- if ((res = av_new_packet(pkt, len-2)) < 0)
+ len -= 2;
+ if (len < 4)
+ goto skip;
+ if ((res = av_new_packet(pkt, len)) < 0)
return res;
avio_read(pb, pkt->data, 4);
if (AV_RB32(pkt->data) == 0xffd8ffd9 ||
@@ -220,6 +235,7 @@ static int swf_read_packet(AVFormatContext *s, AVPacket
*pkt)
return pkt->size;
}
skip:
+ len = FFMAX(0, len);
avio_skip(pb, len);
}
}
--
1.7.1
_______________________________________________
libav-devel mailing list
[email protected]
https://lists.libav.org/mailman/listinfo/libav-devel
