lance.lmw...@gmail.com:
> From: Limin Wang <lance.lmw...@gmail.com>
>
> Signed-off-by: Limin Wang <lance.lmw...@gmail.com>
> ---
> libavformat/mpegts.c | 49
> +++++++++++++++++++++++++++++++++++++++++++++----
> tests/ref/fate/ts-demux | 2 +-
> 2 files changed, 46 insertions(+), 5 deletions(-)
>
> diff --git a/libavformat/mpegts.c b/libavformat/mpegts.c
> index c6fd3e1..b5ea5a1 100644
> --- a/libavformat/mpegts.c
> +++ b/libavformat/mpegts.c
> @@ -29,6 +29,7 @@
> #include "libavutil/opt.h"
> #include "libavutil/avassert.h"
> #include "libavutil/dovi_meta.h"
> +#include "libavutil/mpegts_audio_desc_metadata.h"
> #include "libavcodec/bytestream.h"
> #include "libavcodec/get_bits.h"
> #include "libavcodec/opus.h"
> @@ -2073,16 +2074,56 @@ int ff_parse_mpeg2_descriptor(AVFormatContext *fc,
> AVStream *st, int stream_type
> break;
> case 0x6a: /* ac-3_descriptor */
> {
> - int component_type_flag = get8(pp, desc_end) & (1 << 7);
> - if (component_type_flag) {
> - int component_type = get8(pp, desc_end);
> + int ret;
> + uint8_t buf;
> + size_t desc6a_size;
> + AVDescriptor6A *desc6a;
> +
> + if (desc_end - *pp < 1)
> + return AVERROR_INVALIDDATA;
> +
> + desc6a = av_desc6a_alloc(&desc6a_size);
> + if (!desc6a)
> + return AVERROR(ENOMEM);
> + buf = get8(pp, desc_end);
> + desc6a->component_type_flag = (buf >> 7) & 0x1;
> + desc6a->bsid_flag = (buf >> 6) & 0x1;
> + desc6a->mainid_flag = (buf >> 5) & 0x1;
> + desc6a->asvc_flag = (buf >> 4) & 0x1;
> + if (desc6a->component_type_flag) {
> int service_type_mask = 0x38; // 0b00111000
> - int service_type = ((component_type & service_type_mask) >>
> 3);
> + int service_type;
> +
> + if (desc_end - *pp < 1)
> + return AVERROR_INVALIDDATA;
> + desc6a->component_type = get8(pp, desc_end);
> + service_type = ((desc6a->component_type & service_type_mask)
> >> 3);
> if (service_type == 0x02 /* 0b010 */) {
> st->disposition |= AV_DISPOSITION_DESCRIPTIONS;
> av_log(ts ? ts->stream : fc, AV_LOG_DEBUG, "New track
> disposition for id %u: %u\n", st->id, st->disposition);
> }
> }
> + if (desc6a->bsid_flag) {
> + if (desc_end - *pp < 1)
> + return AVERROR_INVALIDDATA;
> + desc6a->bsid = get8(pp, desc_end);
> + }
> + if (desc6a->mainid_flag) {
> + if (desc_end - *pp < 1)
> + return AVERROR_INVALIDDATA;
> + desc6a->mainid = get8(pp, desc_end);
> + }
> + if (desc6a->asvc_flag) {
> + if (desc_end - *pp < 1)
> + return AVERROR_INVALIDDATA;
desc6a leaks in each of these error paths.
> + desc6a->asvc_flag = get8(pp, desc_end);
> + }
> + ret = av_stream_add_side_data(st, AV_PKT_DATA_MPEGTS_DESC_6A,
> + (uint8_t *)desc6a, desc6a_size);
> + if (ret < 0) {
> + av_free(desc6a);
> + return ret;
> + }
> }
> break;
> case 0x7a: /* enhanced_ac-3_descriptor */
> diff --git a/tests/ref/fate/ts-demux b/tests/ref/fate/ts-demux
> index cdf34d6..dfe0374 100644
> --- a/tests/ref/fate/ts-demux
> +++ b/tests/ref/fate/ts-demux
> @@ -10,7 +10,7 @@
> #sample_rate 1: 48000
> #channel_layout 1: 60f
> #channel_layout_name 1: 5.1(side)
> -1, 0, 0, 2880, 1536, 0x773ffeea, S=1, 1,
> 0x00bd00bd
> +1, 0, 0, 2880, 1536, 0x773ffeea, S=2, 1,
> 0x00bd00bd, 9, 0x00000000
> 1, 2880, 2880, 2880, 1536, 0x6dc10748
> 1, 5760, 5760, 2880, 1536, 0xbab5129c
> 1, 8640, 8640, 2880, 1536, 0x602f034b, S=1, 1,
> 0x00bd00bd
>
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
