[MPlayer-cvslog] r34246 - in trunk/libmpdemux: mpeg_hdr.c mpeg_hdr.h

[reimar]

Author: reimar
Date: Mon Oct 24 18:15:02 2011
New Revision: 34246

Log:
Stop h264_parse_sps and mp_vc1_decode_sequence_header from corrupting the
provided buffer.

This caused problems with more strict H.264 decoders.

Modified:
   trunk/libmpdemux/mpeg_hdr.c
   trunk/libmpdemux/mpeg_hdr.h

Modified: trunk/libmpdemux/mpeg_hdr.c
==============================================================================
--- trunk/libmpdemux/mpeg_hdr.c	Sun Oct 23 22:40:31 2011	(r34245)
+++ trunk/libmpdemux/mpeg_hdr.c	Mon Oct 24 18:15:02 2011	(r34246)
@@ -370,12 +370,10 @@ static int h264_parse_vui(mp_mpeg_header
   return n;
 }
 
-static int mp_unescape03(unsigned char *buf, int len)
+static int mp_unescape03(uint8_t *dest, const uint8_t *buf, int len)
 {
-  unsigned char *dest;
   int i, j, skip;
 
-  dest = malloc(len);
   if(! dest)
     return 0;
 
@@ -399,18 +397,17 @@ static int mp_unescape03(unsigned char *
   dest[j] = buf[len-2];
   dest[j+1] = buf[len-1];
   len -= skip;
-  memcpy(buf, dest, len);
-  free(dest);
 
   return len;
 }
 
-int h264_parse_sps(mp_mpeg_header_t * picture, unsigned char * buf, int len)
+int h264_parse_sps(mp_mpeg_header_t * picture, const unsigned char * inbuf, int len)
 {
   unsigned int n = 0, v, i, k, mbh;
   int frame_mbs_only;
+  uint8_t *buf = malloc(len);
 
-  len = mp_unescape03(buf, len);
+  len = mp_unescape03(buf, inbuf, len);
 
   picture->fps = picture->timeinc_unit = picture->timeinc_resolution = 0;
   n = 24;
@@ -465,14 +462,17 @@ int h264_parse_sps(mp_mpeg_header_t * pi
   if(getbits(buf, n++, 1))
     n = h264_parse_vui(picture, buf, n);
 
+  free(buf);
+
   return n;
 }
 
-int mp_vc1_decode_sequence_header(mp_mpeg_header_t * picture, unsigned char * buf, int len)
+int mp_vc1_decode_sequence_header(mp_mpeg_header_t * picture, const unsigned char * inbuf, int len)
 {
   int n, x;
+  uint8_t *buf = malloc(len);
 
-  len = mp_unescape03(buf, len);
+  len = mp_unescape03(buf, inbuf, len);
 
   picture->display_picture_width = picture->display_picture_height = 0;
   picture->fps = 0;
@@ -480,7 +480,7 @@ int mp_vc1_decode_sequence_header(mp_mpe
   x = getbits(buf, n, 2);
   n += 2;
   if(x != 3) //not advanced profile
-    return 0;
+    goto err_out;
 
   getbits16(buf, n, 14);
   n += 14;
@@ -534,6 +534,10 @@ int mp_vc1_decode_sequence_header(mp_mpe
     }
   }
 
-  //free(dest);
+  free(buf);
   return 1;
+
+err_out:
+  free(buf);
+  return 0;
 }

Modified: trunk/libmpdemux/mpeg_hdr.h
==============================================================================
--- trunk/libmpdemux/mpeg_hdr.h	Sun Oct 23 22:40:31 2011	(r34245)
+++ trunk/libmpdemux/mpeg_hdr.h	Mon Oct 24 18:15:02 2011	(r34246)
@@ -47,8 +47,8 @@ int mp_header_process_extension (mp_mpeg
 float mpeg12_aspect_info(mp_mpeg_header_t *picture);
 int mp4_header_process_vol(mp_mpeg_header_t * picture, unsigned char * buffer);
 void mp4_header_process_vop(mp_mpeg_header_t * picture, unsigned char * buffer);
-int h264_parse_sps(mp_mpeg_header_t * picture, unsigned char * buf, int len);
-int mp_vc1_decode_sequence_header(mp_mpeg_header_t * picture, unsigned char * buf, int len);
+int h264_parse_sps(mp_mpeg_header_t * picture, const unsigned char * buf, int len);
+int mp_vc1_decode_sequence_header(mp_mpeg_header_t * picture, const unsigned char * buf, int len);
 
 unsigned char mp_getbits(unsigned char *buffer, unsigned int from, unsigned char len);