| 
				
				
					
				
				
				 | 
			
			 | 
			@@ -282,11 +282,9 @@ static int track_header(VividasDemuxContext *viv, AVFormatContext *s,  uint8_t * | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			    int64_t off; | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			    int val_1; | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			    int num_video; | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			    AVIOContext *pb; | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			    AVIOContext pb0, *pb = &pb0; | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			
  | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			    pb = avio_alloc_context(buf, size, 0, NULL, NULL, NULL, NULL); | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			    if (!pb) | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			        return AVERROR(ENOMEM); | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			    ffio_init_context(pb, buf, size, 0, NULL, NULL, NULL, NULL); | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			
  | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			    ffio_read_varlen(pb); // track_header_len | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			    avio_r8(pb); // '1' | 
		
		
	
	
		
			
				| 
				
					
				
				
					
				
				
				 | 
			
			 | 
			@@ -383,7 +381,6 @@ static int track_header(VividasDemuxContext *viv, AVFormatContext *s,  uint8_t * | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			            for (j = 0; j < num_data; j++) { | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			                uint64_t len = ffio_read_varlen(pb); | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			                if (len > INT_MAX/2 - xd_size) { | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			                    av_free(pb); | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			                    return AVERROR_INVALIDDATA; | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			                } | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			                data_len[j] = len; | 
		
		
	
	
		
			
				| 
				
				
				
					
				
				 | 
			
			 | 
			@@ -392,7 +389,6 @@ static int track_header(VividasDemuxContext *viv, AVFormatContext *s,  uint8_t * | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			
  | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			            st->codecpar->extradata_size = 64 + xd_size + xd_size / 255; | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			            if (ff_alloc_extradata(st->codecpar, st->codecpar->extradata_size)) { | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			                av_free(pb); | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			                return AVERROR(ENOMEM); | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			            } | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			
  | 
		
		
	
	
		
			
				| 
				
				
				
					
				
				 | 
			
			 | 
			@@ -402,7 +398,6 @@ static int track_header(VividasDemuxContext *viv, AVFormatContext *s,  uint8_t * | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			            for (j = 0; j < num_data - 1; j++) { | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			                unsigned delta = av_xiphlacing(&p[offset], data_len[j]); | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			                if (delta > data_len[j]) { | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			                    av_free(pb); | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			                    return AVERROR_INVALIDDATA; | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			                } | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			                offset += delta; | 
		
		
	
	
		
			
				| 
				
				
				
					
				
				 | 
			
			 | 
			@@ -423,7 +418,6 @@ static int track_header(VividasDemuxContext *viv, AVFormatContext *s,  uint8_t * | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			        } | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			    } | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			
  | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			    av_free(pb); | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			    return 0; | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			} | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			
  | 
		
		
	
	
		
			
				| 
				
				
				
					
				
				 | 
			
			 | 
			@@ -432,13 +426,11 @@ static int track_index(VividasDemuxContext *viv, AVFormatContext *s, uint8_t *bu | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			    int64_t off; | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			    int64_t poff; | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			    int maxnp=0; | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			    AVIOContext *pb; | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			    AVIOContext pb0, *pb = &pb0; | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			    int i; | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			    int64_t filesize = avio_size(s->pb); | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			
  | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			    pb = avio_alloc_context(buf, size, 0, NULL, NULL, NULL, NULL); | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			    if (!pb) | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			        return AVERROR(ENOMEM); | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			    ffio_init_context(pb, buf, size, 0, NULL, NULL, NULL, NULL); | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			
  | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			    ffio_read_varlen(pb); // track_index_len | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			    avio_r8(pb); // 'c' | 
		
		
	
	
		
			
				| 
				
				
				
					
				
				 | 
			
			 | 
			@@ -448,7 +440,6 @@ static int track_index(VividasDemuxContext *viv, AVFormatContext *s, uint8_t *bu | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			    viv->sb_blocks = av_calloc(viv->n_sb_blocks, sizeof(VIV_SB_block)); | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			    if (!viv->sb_blocks) { | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			        viv->n_sb_blocks = 0; | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			        av_free(pb); | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			        return AVERROR(ENOMEM); | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			    } | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			
  | 
		
		
	
	
		
			
				| 
				
					
				
				
					
				
				
				 | 
			
			 | 
			@@ -479,11 +470,9 @@ static int track_index(VividasDemuxContext *viv, AVFormatContext *s, uint8_t *bu | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			        goto error; | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			
  | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			    viv->sb_entries = av_calloc(maxnp, sizeof(VIV_SB_entry)); | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			    av_free(pb); | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			
  | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			    return 0; | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			error: | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			    av_free(pb); | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			    viv->n_sb_blocks = 0; | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			    av_freep(&viv->sb_blocks); | 
		
		
	
		
			
			 | 
			 | 
			
			 | 
			    return AVERROR_INVALIDDATA; | 
		
		
	
	
		
			
				| 
				
					
				
				
				
				 | 
			
			 | 
			
  |