|
|
|
@@ -580,7 +580,7 @@ static int asf_read_header(AVFormatContext *s) |
|
|
|
|
|
|
|
ff_get_guid(pb, &g); |
|
|
|
if (ff_guidcmp(&g, &ff_asf_header)) |
|
|
|
return -1; |
|
|
|
return AVERROR_INVALIDDATA; |
|
|
|
avio_rl64(pb); |
|
|
|
avio_rl32(pb); |
|
|
|
avio_r8(pb); |
|
|
|
@@ -604,7 +604,7 @@ static int asf_read_header(AVFormatContext *s) |
|
|
|
break; |
|
|
|
} |
|
|
|
if (gsize < 24) |
|
|
|
return -1; |
|
|
|
return AVERROR_INVALIDDATA; |
|
|
|
if (!ff_guidcmp(&g, &ff_asf_file_header)) { |
|
|
|
int ret = asf_read_file_properties(s, gsize); |
|
|
|
if (ret < 0) |
|
|
|
@@ -632,7 +632,7 @@ static int asf_read_header(AVFormatContext *s) |
|
|
|
} else if (!ff_guidcmp(&g, &ff_asf_marker_header)) { |
|
|
|
asf_read_marker(s, gsize); |
|
|
|
} else if (url_feof(pb)) { |
|
|
|
return -1; |
|
|
|
return AVERROR_EOF; |
|
|
|
} else { |
|
|
|
if (!s->keylen) { |
|
|
|
if (!ff_guidcmp(&g, &ff_asf_content_encryption)) { |
|
|
|
@@ -665,7 +665,7 @@ static int asf_read_header(AVFormatContext *s) |
|
|
|
avio_r8(pb); |
|
|
|
avio_r8(pb); |
|
|
|
if (url_feof(pb)) |
|
|
|
return -1; |
|
|
|
return AVERROR_EOF; |
|
|
|
asf->data_offset = avio_tell(pb); |
|
|
|
asf->packet_size_left = 0; |
|
|
|
|
|
|
|
@@ -758,7 +758,7 @@ static int ff_asf_get_packet(AVFormatContext *s, AVIOContext *pb) |
|
|
|
if (d || e) { |
|
|
|
if (!url_feof(pb)) |
|
|
|
av_log(s, AV_LOG_ERROR, "ff asf bad non zero\n"); |
|
|
|
return -1; |
|
|
|
return AVERROR_INVALIDDATA; |
|
|
|
} |
|
|
|
c= avio_r8(pb); |
|
|
|
d= avio_r8(pb); |
|
|
|
@@ -777,11 +777,11 @@ static int ff_asf_get_packet(AVFormatContext *s, AVIOContext *pb) |
|
|
|
//the following checks prevent overflows and infinite loops |
|
|
|
if(!packet_length || packet_length >= (1U<<29)){ |
|
|
|
av_log(s, AV_LOG_ERROR, "invalid packet_length %d at:%"PRId64"\n", packet_length, avio_tell(pb)); |
|
|
|
return -1; |
|
|
|
return AVERROR_INVALIDDATA; |
|
|
|
} |
|
|
|
if(padsize >= packet_length){ |
|
|
|
av_log(s, AV_LOG_ERROR, "invalid padsize %d at:%"PRId64"\n", padsize, avio_tell(pb)); |
|
|
|
return -1; |
|
|
|
return AVERROR_INVALIDDATA; |
|
|
|
} |
|
|
|
|
|
|
|
asf->packet_timestamp = avio_rl32(pb); |
|
|
|
@@ -800,7 +800,7 @@ static int ff_asf_get_packet(AVFormatContext *s, AVIOContext *pb) |
|
|
|
av_log(s, AV_LOG_ERROR, |
|
|
|
"invalid packet header length %d for pktlen %d-%d at %"PRId64"\n", |
|
|
|
rsize, packet_length, padsize, avio_tell(pb)); |
|
|
|
return -1; |
|
|
|
return AVERROR_INVALIDDATA; |
|
|
|
} |
|
|
|
asf->packet_size_left = packet_length - padsize - rsize; |
|
|
|
if (packet_length < asf->hdr.min_pktsize) |
|
|
|
@@ -830,13 +830,13 @@ static int asf_read_frame_header(AVFormatContext *s, AVIOContext *pb){ |
|
|
|
//printf("key:%d stream:%d seq:%d offset:%d replic_size:%d\n", asf->packet_key_frame, asf->stream_index, asf->packet_seq, //asf->packet_frag_offset, asf->packet_replic_size); |
|
|
|
if (rsize+asf->packet_replic_size > asf->packet_size_left) { |
|
|
|
av_log(s, AV_LOG_ERROR, "packet_replic_size %d is invalid\n", asf->packet_replic_size); |
|
|
|
return -1; |
|
|
|
return AVERROR_INVALIDDATA; |
|
|
|
} |
|
|
|
if (asf->packet_replic_size >= 8) { |
|
|
|
asf->packet_obj_size = avio_rl32(pb); |
|
|
|
if(asf->packet_obj_size >= (1<<24) || asf->packet_obj_size <= 0){ |
|
|
|
av_log(s, AV_LOG_ERROR, "packet_obj_size invalid\n"); |
|
|
|
return -1; |
|
|
|
return AVERROR_INVALIDDATA; |
|
|
|
} |
|
|
|
asf->packet_frag_timestamp = avio_rl32(pb); // timestamp |
|
|
|
if(asf->packet_replic_size >= 8+38+4){ |
|
|
|
@@ -864,17 +864,17 @@ static int asf_read_frame_header(AVFormatContext *s, AVIOContext *pb){ |
|
|
|
rsize++; |
|
|
|
}else if(asf->packet_replic_size!=0){ |
|
|
|
av_log(s, AV_LOG_ERROR, "unexpected packet_replic_size of %d\n", asf->packet_replic_size); |
|
|
|
return -1; |
|
|
|
return AVERROR_INVALIDDATA; |
|
|
|
} |
|
|
|
if (asf->packet_flags & 0x01) { |
|
|
|
DO_2BITS(asf->packet_segsizetype >> 6, asf->packet_frag_size, 0); // 0 is illegal |
|
|
|
if (rsize > asf->packet_size_left) { |
|
|
|
av_log(s, AV_LOG_ERROR, "packet_replic_size is invalid\n"); |
|
|
|
return -1; |
|
|
|
return AVERROR_INVALIDDATA; |
|
|
|
} else if(asf->packet_frag_size > asf->packet_size_left - rsize){ |
|
|
|
if (asf->packet_frag_size > asf->packet_size_left - rsize + asf->packet_padsize) { |
|
|
|
av_log(s, AV_LOG_ERROR, "packet_frag_size is invalid (%d-%d)\n", asf->packet_size_left, rsize); |
|
|
|
return -1; |
|
|
|
return AVERROR_INVALIDDATA; |
|
|
|
} else { |
|
|
|
int diff = asf->packet_frag_size - (asf->packet_size_left - rsize); |
|
|
|
asf->packet_size_left += diff; |
|
|
|
@@ -889,7 +889,7 @@ static int asf_read_frame_header(AVFormatContext *s, AVIOContext *pb){ |
|
|
|
if (asf->packet_replic_size == 1) { |
|
|
|
asf->packet_multi_size = asf->packet_frag_size; |
|
|
|
if (asf->packet_multi_size > asf->packet_size_left) |
|
|
|
return -1; |
|
|
|
return AVERROR_INVALIDDATA; |
|
|
|
} |
|
|
|
asf->packet_size_left -= rsize; |
|
|
|
//printf("___objsize____ %d %d rs:%d\n", asf->packet_obj_size, asf->packet_frag_offset, rsize); |
|
|
|
|