On Tue, Jul 28, 2020 at 06:55:14PM +0200, Andreas Rheinhardt wrote:
> lance.lmw...@gmail.com:
> > From: Limin Wang <lance.lmw...@gmail.com>
> >
> > Signed-off-by: Limin Wang <lance.lmw...@gmail.com>
> > ---
> > libavformat/mpegts.c | 49
> > +++++++++++++++++++++++++++++++++++++++++++++----
> > tests/ref/fate/ts-demux | 2 +-
> > 2 files changed, 46 insertions(+), 5 deletions(-)
> >
> > diff --git a/libavformat/mpegts.c b/libavformat/mpegts.c
> > index c6fd3e1..b5ea5a1 100644
> > --- a/libavformat/mpegts.c
> > +++ b/libavformat/mpegts.c
> > @@ -29,6 +29,7 @@
> > #include "libavutil/opt.h"
> > #include "libavutil/avassert.h"
> > #include "libavutil/dovi_meta.h"
> > +#include "libavutil/mpegts_audio_desc_metadata.h"
> > #include "libavcodec/bytestream.h"
> > #include "libavcodec/get_bits.h"
> > #include "libavcodec/opus.h"
> > @@ -2073,16 +2074,56 @@ int ff_parse_mpeg2_descriptor(AVFormatContext *fc,
> > AVStream *st, int stream_type
> > break;
> > case 0x6a: /* ac-3_descriptor */
> > {
> > - int component_type_flag = get8(pp, desc_end) & (1 << 7);
> > - if (component_type_flag) {
> > - int component_type = get8(pp, desc_end);
> > + int ret;
> > + uint8_t buf;
> > + size_t desc6a_size;
> > + AVDescriptor6A *desc6a;
> > +
> > + if (desc_end - *pp < 1)
> > + return AVERROR_INVALIDDATA;
> > +
> > + desc6a = av_desc6a_alloc(&desc6a_size);
> > + if (!desc6a)
> > + return AVERROR(ENOMEM);
> > + buf = get8(pp, desc_end);
> > + desc6a->component_type_flag = (buf >> 7) & 0x1;
> > + desc6a->bsid_flag = (buf >> 6) & 0x1;
> > + desc6a->mainid_flag = (buf >> 5) & 0x1;
> > + desc6a->asvc_flag = (buf >> 4) & 0x1;
> > + if (desc6a->component_type_flag) {
> > int service_type_mask = 0x38; // 0b00111000
> > - int service_type = ((component_type & service_type_mask)
> > >> 3);
> > + int service_type;
> > +
> > + if (desc_end - *pp < 1)
> > + return AVERROR_INVALIDDATA;
> > + desc6a->component_type = get8(pp, desc_end);
> > + service_type = ((desc6a->component_type &
> > service_type_mask) >> 3);
> > if (service_type == 0x02 /* 0b010 */) {
> > st->disposition |= AV_DISPOSITION_DESCRIPTIONS;
> > av_log(ts ? ts->stream : fc, AV_LOG_DEBUG, "New track
> > disposition for id %u: %u\n", st->id, st->disposition);
> > }
> > }
> > + if (desc6a->bsid_flag) {
> > + if (desc_end - *pp < 1)
> > + return AVERROR_INVALIDDATA;
> > + desc6a->bsid = get8(pp, desc_end);
> > + }
> > + if (desc6a->mainid_flag) {
> > + if (desc_end - *pp < 1)
> > + return AVERROR_INVALIDDATA;
> > + desc6a->mainid = get8(pp, desc_end);
> > + }
> > + if (desc6a->asvc_flag) {
> > + if (desc_end - *pp < 1)
> > + return AVERROR_INVALIDDATA;
>
> desc6a leaks in each of these error paths.
thanks, will fix it.
>
> > + desc6a->asvc_flag = get8(pp, desc_end);
> > + }
> > + ret = av_stream_add_side_data(st, AV_PKT_DATA_MPEGTS_DESC_6A,
> > + (uint8_t *)desc6a, desc6a_size);
> > + if (ret < 0) {
> > + av_free(desc6a);
> > + return ret;
> > + }
> > }
> > break;
> > case 0x7a: /* enhanced_ac-3_descriptor */
> > diff --git a/tests/ref/fate/ts-demux b/tests/ref/fate/ts-demux
> > index cdf34d6..dfe0374 100644
> > --- a/tests/ref/fate/ts-demux
> > +++ b/tests/ref/fate/ts-demux
> > @@ -10,7 +10,7 @@
> > #sample_rate 1: 48000
> > #channel_layout 1: 60f
> > #channel_layout_name 1: 5.1(side)
> > -1, 0, 0, 2880, 1536, 0x773ffeea, S=1, 1,
> > 0x00bd00bd
> > +1, 0, 0, 2880, 1536, 0x773ffeea, S=2, 1,
> > 0x00bd00bd, 9, 0x00000000
> > 1, 2880, 2880, 2880, 1536, 0x6dc10748
> > 1, 5760, 5760, 2880, 1536, 0xbab5129c
> > 1, 8640, 8640, 2880, 1536, 0x602f034b, S=1, 1,
> > 0x00bd00bd
> >
>
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel@ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
>
> To unsubscribe, visit link above, or email
> ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
--
Thanks,
Limin Wang
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
