[FFmpeg-devel] [PATCH 2/2] MxPEG decoder

[Anatoly Nenashev]

On 01.11.2010 01:17, Michael Niedermayer wrote:
> On Sun, Oct 31, 2010 at 09:23:13PM +0300, Anatoly Nenashev wrote:
>    
>> Patch for .mxg demuxer
>>      
> [...]
>    
>> +static int mxg_read_header(AVFormatContext *s, AVFormatParameters *ap)
>> +{
>> +    AVStream *video_st = 0, *audio_st = 0;
>> +    MXGContext *mxg = s->priv_data;
>> +
>> +    /* video parameters will be extracted from the compressed bitstream */
>> +    video_st = av_new_stream(s, VIDEO_STREAM_INDEX);
>> +    if (!video_st)
>> +        return AVERROR(ENOMEM);
>> +    video_st->codec->codec_type = AVMEDIA_TYPE_VIDEO;
>> +    video_st->codec->codec_id = CODEC_ID_MXPEG;
>> +    av_set_pts_info(video_st, 64, 1, 1000000);
>> +
>> +    audio_st = av_new_stream(s, AUDIO_STREAM_INDEX);
>> +    if (!audio_st)
>> +        return AVERROR(ENOMEM);
>> +    audio_st->codec->codec_type = AVMEDIA_TYPE_AUDIO;
>> +    audio_st->codec->codec_id = CODEC_ID_PCM_ALAW;
>> +    audio_st->codec->channels = 1;
>> +    audio_st->codec->sample_rate = 8000;
>> +    audio_st->codec->bits_per_coded_sample = 8;
>> +    audio_st->codec->block_align = 1;
>> +
>>      
>    
>> +    mxg->buffer = (uint8_t*) av_malloc(DEFAULT_PACKET_SIZE);
>>      
> unneeded cast
>    

removed

> [...]
>    
>> +        if (mxg->found_video_packet) {
>> +            mxg->buffer[mxg->current_pos++] = data;
>> +            if (mxg->state == 0xfffe) {
>> +                int size = get_be16(s->pb);
>> +                if (url_feof(s->pb) || url_ferror(s->pb))
>> +                    return AVERROR_EOF;
>> +                mxg->buffer = av_fast_realloc(mxg->buffer,&mxg->buffer_size,
>> +                                              mxg->current_pos + size);
>>      
> here the + and similar at other points can overflow and lead to realloc to a
> too small buffer
>    

fixed

> [...]
>    
>> +            if (mxg->current_pos>= mxg->buffer_size) {
>> +                mxg->buffer = (uint8_t*) av_fast_realloc(mxg->buffer,&mxg->buffer_size,
>>      
> unneeded cast
>    

removed

-------------- next part --------------
A non-text attachment was scrubbed...
Name: mxg_v2.patch
Type: text/x-patch
Size: 8356 bytes
Desc: not available
URL: <http://lists.mplayerhq.hu/pipermail/ffmpeg-devel/attachments/20101101/6e102fc1/attachment.bin>