highperfocused/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

electronicarts: do not fail on zero-sized chunks

Browse Source 
At least one FATE sample contains such chunks and happens to work simply
by accident (due to find_stream_info() swallowing the error).

CC: libav-stable@libav.org
This commit is contained in:
Anton Khirnov 2014-08-20 05:40:53 +00:00
parent dc4b2e7d33
commit 4d6c515284
1 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
libavformat/electronicarts.c
View File

@ -522,7 +522,7 @@ static int ea_read_packet(AVFormatContext *s, AVPacket *pkt)
while (!packet_read) { while (!packet_read) {
chunk_type = avio_rl32(pb); chunk_type = avio_rl32(pb);
chunk_size = ea->big_endian ? avio_rb32(pb) : avio_rl32(pb); chunk_size = ea->big_endian ? avio_rb32(pb) : avio_rl32(pb);
if (chunk_size <= 8) if (chunk_size < 8)
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
chunk_size -= 8; chunk_size -= 8;
@ -547,6 +547,9 @@ static int ea_read_packet(AVFormatContext *s, AVPacket *pkt)
avio_skip(pb, 8); avio_skip(pb, 8);
chunk_size -= 12; chunk_size -= 12;
} }
if (!chunk_size)
continue;
ret = av_get_packet(pb, pkt, chunk_size); ret = av_get_packet(pb, pkt, chunk_size);
if (ret < 0) if (ret < 0)
return ret; return ret;
@ -607,6 +610,9 @@ static int ea_read_packet(AVFormatContext *s, AVPacket *pkt)
goto get_video_packet; goto get_video_packet;
case mTCD_TAG: case mTCD_TAG:
if (chunk_size < 8)
return AVERROR_INVALIDDATA;
avio_skip(pb, 8); // skip ea DCT header avio_skip(pb, 8); // skip ea DCT header
chunk_size -= 8; chunk_size -= 8;
goto get_video_packet; goto get_video_packet;
@ -617,6 +623,9 @@ static int ea_read_packet(AVFormatContext *s, AVPacket *pkt)
key = AV_PKT_FLAG_KEY; key = AV_PKT_FLAG_KEY;
case MV0F_TAG: case MV0F_TAG:
get_video_packet: get_video_packet:
if (!chunk_size)
continue;
ret = av_get_packet(pb, pkt, chunk_size); ret = av_get_packet(pb, pkt, chunk_size);
if (ret < 0) if (ret < 0)
return ret; return ret;