On Fri, Dec 19, 2014 at 12:59:16AM +0100, Vittorio Giovara wrote:
> ---
> This version fixes the stack corruption when parsing the date string.
> Vittorio
> 
>  Changelog                |   2 +-
>  libavformat/Makefile     |   1 +
>  libavformat/allformats.c |   1 +
>  libavformat/dss.c        | 346 
> +++++++++++++++++++++++++++++++++++++++++++++++
>  libavformat/version.h    |   2 +-
>  5 files changed, 350 insertions(+), 2 deletions(-)
>  create mode 100644 libavformat/dss.c

doc update

> --- /dev/null
> +++ b/libavformat/dss.c
> @@ -0,0 +1,346 @@
> +static int dss_read_metadata_date(AVFormatContext *s, unsigned int offset,
> +                                  const char *key)
> +{
> +    AVIOContext *pb = s->pb;
> +    char datetime[64], string[DSS_TIME_SIZE + 1] = { 0 };
> +    int y, month, d, h, minute, sec;
> +    int ret;
> +
> +    avio_seek(pb, offset, SEEK_SET);
> +
> +    ret = avio_read(s->pb, string, DSS_TIME_SIZE);
> +    if (ret < DSS_TIME_SIZE)
> +        return ret < 0 ? ret : AVERROR_EOF;
> +
> +    sscanf(string, "%2d%2d%2d%2d%2d%2d", &y, &month, &d, &h, &minute, &sec);
> +    /* We deal here with two digit year, so set default date to 2000

We deal with a two-digit year here, ..

> +     * and hope it will never be used in next century. */

in the next

> +static int dss_read_metadata_string(AVFormatContext *s, unsigned int offset,
> +                                    unsigned int size, const char *key)
> +{
> +    AVIOContext *pb = s->pb;
> +    char *value;
> +    int ret;
> +
> +    avio_seek(pb, offset, SEEK_SET);
> +
> +    value = av_malloc(size + 1);
> +    if (!value)
> +        return AVERROR(ENOMEM);
> +    /* make sure that string will end with \0 */
> +    *(value + size) = '\0';

Why not av_mallocz instead?

> +    /* theoretically dss contrainer can */
> +    priv->dss_sp_buf = av_malloc(DSS_FRAME_SIZE + 1);

cont_ainer

The container can ... what?

> +    dss_sp_byte_swap(priv, pkt->data, priv->dss_sp_buf);
> +
> +    if (pkt->data[0] == 0xff)
> +        return AVERROR_INVALIDDATA;
> +
> +    return pkt->size;
> +error_eof:
> +    av_free_packet(pkt);
> +    return ret < 0 ? ret : AVERROR_EOF;

I'd add an empty line before the goto label for readability.

> +    /* We make here one byte step.
> +     * Don't forget to add offset. */

/* We make one-byte steps here. Don't forget to add offset. */

Diego
_______________________________________________
libav-devel mailing list
[email protected]
https://lists.libav.org/mailman/listinfo/libav-devel

Reply via email to