Add some additional checks for EOF and print error messages on an incomplete header or packet. --- libavformat/idcin.c | 37 ++++++++++++++++++++++++++++++------- 1 files changed, 30 insertions(+), 7 deletions(-)
diff --git a/libavformat/idcin.c b/libavformat/idcin.c index 8cd86d1..b894355 100644 --- a/libavformat/idcin.c +++ b/libavformat/idcin.c @@ -147,6 +147,7 @@ static int idcin_read_header(AVFormatContext *s) AVStream *st; unsigned int width, height; unsigned int sample_rate, bytes_per_sample, channels; + int ret; /* get the 5 header parameters */ width = avio_rl32(pb); @@ -155,6 +156,11 @@ static int idcin_read_header(AVFormatContext *s) bytes_per_sample = avio_rl32(pb); channels = avio_rl32(pb); + if (s->pb->eof_reached) { + av_log(s, AV_LOG_ERROR, "incomplete header\n"); + return s->pb->error ? s->pb->error : AVERROR_EOF; + } + if (av_image_check_size(width, height, 0, s) < 0) return AVERROR_INVALIDDATA; if (sample_rate > 0) { @@ -192,9 +198,13 @@ static int idcin_read_header(AVFormatContext *s) /* load up the Huffman tables into extradata */ st->codec->extradata_size = HUFFMAN_TABLE_SIZE; st->codec->extradata = av_malloc(HUFFMAN_TABLE_SIZE); - if (avio_read(pb, st->codec->extradata, HUFFMAN_TABLE_SIZE) != - HUFFMAN_TABLE_SIZE) - return AVERROR(EIO); + ret = avio_read(pb, st->codec->extradata, HUFFMAN_TABLE_SIZE); + if (ret < 0) { + return ret; + } else if (ret != HUFFMAN_TABLE_SIZE) { + av_log(s, AV_LOG_ERROR, "incomplete header\n"); + return AVERROR_EOF; + } if (idcin->audio_present) { idcin->audio_present = 1; @@ -251,16 +261,21 @@ static int idcin_read_packet(AVFormatContext *s, uint32_t palette[256]; if (s->pb->eof_reached) - return AVERROR(EIO); + return s->pb->error ? s->pb->error : AVERROR_EOF; if (idcin->next_chunk_is_video) { command = avio_rl32(pb); if (command == 2) { - return AVERROR(EIO); + return AVERROR_EOF; } else if (command == 1) { /* trigger a palette change */ - if (avio_read(pb, palette_buffer, 768) != 768) - return AVERROR(EIO); + ret = avio_read(pb, palette_buffer, 768); + if (ret < 0) { + return ret; + } else if (ret != 768) { + av_log(s, AV_LOG_ERROR, "incomplete packet\n"); + return AVERROR_EOF; + } /* scale the palette as necessary */ palette_scale = 2; for (i = 0; i < 768; i++) @@ -277,6 +292,10 @@ static int idcin_read_packet(AVFormatContext *s, } } + if (s->pb->eof_reached) { + av_log(s, AV_LOG_ERROR, "incomplete packet\n"); + return s->pb->error ? s->pb->error : AVERROR_EOF; + } chunk_size = avio_rl32(pb); if (chunk_size < 4 || chunk_size > INT_MAX - 4) { av_log(s, AV_LOG_ERROR, "invalid chunk size: %u\n", chunk_size); @@ -288,6 +307,10 @@ static int idcin_read_packet(AVFormatContext *s, ret= av_get_packet(pb, pkt, chunk_size); if (ret < 0) return ret; + else if (ret != chunk_size) { + av_log(s, AV_LOG_ERROR, "incomplete packet\n"); + return AVERROR_EOF; + } if (command == 1) { uint8_t *pal; -- 1.7.1 _______________________________________________ libav-devel mailing list libav-devel@libav.org https://lists.libav.org/mailman/listinfo/libav-devel