[FFmpeg-cvslog] ffm: reject invalid codec_id and codec_type
Andreas Cadhalpun
git at videolan.org
Sun Dec 20 16:01:21 CET 2015
ffmpeg | branch: release/2.5 | Andreas Cadhalpun <Andreas.Cadhalpun at googlemail.com> | Mon Dec 14 22:11:55 2015 +0100| [5478e7bbc106b5781b7a49429b2b9db0f2d4f378] | committer: Andreas Cadhalpun
ffm: reject invalid codec_id and codec_type
A negative codec_id cannot be handled by the found_decoder API of
AVStream->info: if the codec_id is not recognized, found_decoder is set
to -codec_id, which has to be '<0' according to the API documentation.
This can cause NULL pointer dereferencing in try_decode_frame.
Also make sure the codec_type matches the expected one for codec_id.
Reviewed-by: Michael Niedermayer <michael at niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun at googlemail.com>
(cherry picked from commit ecf63b7cc24b9fd3e6d604313325dd1ada4db662)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun at googlemail.com>
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=5478e7bbc106b5781b7a49429b2b9db0f2d4f378
---
libavformat/ffmdec.c | 28 ++++++++++++++++++++++++++++
1 file changed, 28 insertions(+)
diff --git a/libavformat/ffmdec.c b/libavformat/ffmdec.c
index 87cf546..b1cc14a 100644
--- a/libavformat/ffmdec.c
+++ b/libavformat/ffmdec.c
@@ -267,6 +267,7 @@ static int ffm2_read_header(AVFormatContext *s)
AVStream *st;
AVIOContext *pb = s->pb;
AVCodecContext *codec;
+ const AVCodecDescriptor *codec_desc;
int ret;
int f_main = 0, f_cprv = -1, f_stvi = -1, f_stau = -1;
AVCodec *enc;
@@ -321,7 +322,20 @@ static int ffm2_read_header(AVFormatContext *s)
codec = st->codec;
/* generic info */
codec->codec_id = avio_rb32(pb);
+ codec_desc = avcodec_descriptor_get(codec->codec_id);
+ if (!codec_desc) {
+ av_log(s, AV_LOG_ERROR, "Invalid codec id: %d\n", codec->codec_id);
+ codec->codec_id = AV_CODEC_ID_NONE;
+ goto fail;
+ }
codec->codec_type = avio_r8(pb);
+ if (codec->codec_type != codec_desc->type) {
+ av_log(s, AV_LOG_ERROR, "Codec type mismatch: expected %d, found %d\n",
+ codec_desc->type, codec->codec_type);
+ codec->codec_id = AV_CODEC_ID_NONE;
+ codec->codec_type = AVMEDIA_TYPE_UNKNOWN;
+ goto fail;
+ }
codec->bit_rate = avio_rb32(pb);
codec->flags = avio_rb32(pb);
codec->flags2 = avio_rb32(pb);
@@ -469,6 +483,7 @@ static int ffm_read_header(AVFormatContext *s)
AVStream *st;
AVIOContext *pb = s->pb;
AVCodecContext *codec;
+ const AVCodecDescriptor *codec_desc;
int i, nb_streams;
uint32_t tag;
@@ -506,7 +521,20 @@ static int ffm_read_header(AVFormatContext *s)
codec = st->codec;
/* generic info */
codec->codec_id = avio_rb32(pb);
+ codec_desc = avcodec_descriptor_get(codec->codec_id);
+ if (!codec_desc) {
+ av_log(s, AV_LOG_ERROR, "Invalid codec id: %d\n", codec->codec_id);
+ codec->codec_id = AV_CODEC_ID_NONE;
+ goto fail;
+ }
codec->codec_type = avio_r8(pb); /* codec_type */
+ if (codec->codec_type != codec_desc->type) {
+ av_log(s, AV_LOG_ERROR, "Codec type mismatch: expected %d, found %d\n",
+ codec_desc->type, codec->codec_type);
+ codec->codec_id = AV_CODEC_ID_NONE;
+ codec->codec_type = AVMEDIA_TYPE_UNKNOWN;
+ goto fail;
+ }
codec->bit_rate = avio_rb32(pb);
codec->flags = avio_rb32(pb);
codec->flags2 = avio_rb32(pb);
More information about the ffmpeg-cvslog
mailing list