[FFmpeg-devel] [PATCH] Core Audio Format demuxer (v5)

[Michael Niedermayer]

On Sun, Sep 06, 2009 at 08:57:43PM +1000, Peter Ross wrote:
> On Sat, Sep 05, 2009 at 05:13:05AM +0200, Michael Niedermayer wrote:
> > On Wed, Aug 26, 2009 at 08:19:26PM +1000, Peter Ross wrote:
> > > On Sat, Aug 15, 2009 at 12:08:35PM +0200, Diego Biurrun wrote:
> > > > On Sat, Aug 15, 2009 at 05:35:42PM +1000, Peter Ross wrote:
> > > > > 
> > > > > Revised patch enclosed.
> > > > 
> > > > .. some nitpicks ..
> > > 
> > > Ok. Revised patched enclosed.
> 
> Next revision of patch enclosed. I have addressed all of Michael's
> comments.
> 

[...]

> +static int read_packet(AVFormatContext *s, AVPacket *pkt)
> +{
> +    ByteIOContext *pb = s->pb;
> +    AVStream *st      = s->streams[0];
> +    CaffContext *caf  = s->priv_data;

> +    int res, pkt_size = 0, pkt_frames = 0;
> +    int64_t left;
> +
> +    if (url_feof(pb))
> +        return AVERROR_IO;
> +
> +    /* don't read past end of data chunk */
> +    left = (caf->data_start + caf->data_size) - url_ftell(pb);
> +    if (left <= 0)
> +        return AVERROR_IO;
> +
> +    pkt_frames = caf->frames_per_packet;
> +    pkt_size   = caf->bytes_per_packet;

write after write without a read between

except that patch ok (assuming noone else has comments left, and it has
been tested)

[...]
>  utils.c |   14 ++++++++++++--
>  1 file changed, 12 insertions(+), 2 deletions(-)
> 81e41f9f083c5af8b752ce271be0b6cbf24bba64  channel-validate.diff
> diff --git a/libavformat/utils.c b/libavformat/utils.c
> index 59fefd2..ac065c5 100644
> --- a/libavformat/utils.c
> +++ b/libavformat/utils.c
> @@ -354,7 +354,7 @@ int av_open_input_stream(AVFormatContext **ic_ptr,
>                           ByteIOContext *pb, const char *filename,
>                           AVInputFormat *fmt, AVFormatParameters *ap)
>  {
> -    int err;
> +    int err, i;
>      AVFormatContext *ic;
>      AVFormatParameters default_ap;
>  
> @@ -394,6 +394,17 @@ int av_open_input_stream(AVFormatContext **ic_ptr,
>              goto fail;
>      }
>  
> +#define SANE_NB_CHANNELS 128
> +    for(i=0;i<ic->nb_streams;i++) {
> +        AVStream *st = ic->streams[i];
> +        if (st->codec->codec_type == CODEC_TYPE_AUDIO &&
> +            st->codec->channels > SANE_NB_CHANNELS) {
> +            av_log(ic, AV_LOG_ERROR, "Stream #%d is corrupt\n", i);
> +            err = AVERROR_INVALIDDATA;
> +            goto fail;
> +        }
> +    }
> +
>      if (pb && !ic->data_offset)
>          ic->data_offset = url_ftell(ic->pb);
>  

i would have thought that the check could be put in avcodec_open() there
 is alraedy a check for width/height there and it would also catch
lavc without lavf but maybe just checking there isnt enough


[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Old school: Use the lowest level language in which you can solve the problem
            conveniently.
New school: Use the highest level language in which the latest supercomputer
            can solve the problem without the user falling asleep waiting.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: Digital signature
URL: <http://lists.mplayerhq.hu/pipermail/ffmpeg-devel/attachments/20090907/91efe543/attachment.pgp>