highperfocused/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fixed segfault on corrupted smacker streams in the demuxer.

Browse Source 
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d0121e8d96)
This commit is contained in:
Laurent Aimar
2011-09-11 18:51:52 +02:00
committed by Michael Niedermayer
parent 2bf9a09a2c
commit 8511c141e0
1 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
libavformat/smacker.c
View File

@@ -291,6 +291,10 @@ static int smacker_read_packet(AVFormatContext *s, AVPacket *pkt)
frame_size -= 4; frame_size -= 4;
smk->curstream++; smk->curstream++;
smk->bufs[smk->curstream] = av_realloc(smk->bufs[smk->curstream], size); smk->bufs[smk->curstream] = av_realloc(smk->bufs[smk->curstream], size);
if (!smk->bufs[smk->curstream]) {
smk->buf_sizes[smk->curstream] = 0;
return AVERROR(ENOMEM);
}
smk->buf_sizes[smk->curstream] = size; smk->buf_sizes[smk->curstream] = size;
ret = avio_read(s->pb, smk->bufs[smk->curstream], size); ret = avio_read(s->pb, smk->bufs[smk->curstream], size);
if(ret != size) if(ret != size)
@@ -299,7 +303,9 @@ static int smacker_read_packet(AVFormatContext *s, AVPacket *pkt)
} }
flags >>= 1; flags >>= 1;
} }
if (av_new_packet(pkt, frame_size + 768)) if (frame_size < 0)
return AVERROR_INVALIDDATA;
if (av_new_packet(pkt, frame_size + 769))
return AVERROR(ENOMEM); return AVERROR(ENOMEM);
if(smk->frm_size[smk->cur_frame] & 1) if(smk->frm_size[smk->cur_frame] & 1)
palchange |= 2; palchange |= 2;