Re: [FFmpeg-devel] [libav-devel] [PATCH 3/3] nutdec: abort if EOF is reached in decode_info_header/read_sm_data

[Andreas Cadhalpun]

On 20.05.2015 16:58, Luca Barbato wrote:
> On 20/05/15 16:35, Andreas Cadhalpun wrote:
>> On 20.05.2015 03:46, Michael Niedermayer wrote:
>>> this could check the return code from get_str()
>>> which would return failure on EOF already i think
>>> that would be slightly simpler
>>
>> No, get_str only fails if len > maxlen, which is not necessarily
>> the case on EOF.
>>
> 
> I think the idea is to embed in get_str the eof check and check its
> result then.

Michael did that [1], so attached is a patch relying on this.

Best regards,
Andreas

1: 
https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=6bbb2f8f4da67af374d62403742482cc5962aa21

>From a6f28198c4f85a32fddf49c52a3444dbf6882b48 Mon Sep 17 00:00:00 2001
From: Andreas Cadhalpun <andreas.cadhal...@googlemail.com>
Date: Wed, 20 May 2015 00:34:42 +0200
Subject: [PATCH 3/3] nutdec: abort if EOF is reached in
 decode_info_header/read_sm_data

These loops can take a lot of time if count is very large.

Signed-off-by: Andreas Cadhalpun <andreas.cadhal...@googlemail.com>
---
 libavformat/nutdec.c | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/libavformat/nutdec.c b/libavformat/nutdec.c
index 8994a91..f1cece8 100644
--- a/libavformat/nutdec.c
+++ b/libavformat/nutdec.c
@@ -492,7 +492,7 @@ static int decode_info_header(NUTContext *nut)
     AVIOContext *bc    = s->pb;
     uint64_t tmp, chapter_start, chapter_len;
     unsigned int stream_id_plus1, count;
-    int chapter_id, i;
+    int chapter_id, i, ret;
     int64_t value, end;
     char name[256], str_value[1024], type_str[256];
     const char *type;
@@ -534,7 +534,11 @@ static int decode_info_header(NUTContext *nut)
     }
 
     for (i = 0; i < count; i++) {
-        get_str(bc, name, sizeof(name));
+        ret = get_str(bc, name, sizeof(name));
+        if (ret < 0) {
+            av_log(s, AV_LOG_ERROR, "get_str failed while decoding info header\n");
+            return ret;
+        }
         value = get_s(bc);
         str_value[0] = 0;
 
@@ -852,14 +856,18 @@ static int read_sm_data(AVFormatContext *s, AVIOContext *bc, AVPacket *pkt, int
     int sample_rate = 0;
     int width = 0;
     int height = 0;
-    int i;
+    int i, ret;
 
     for (i=0; i<count; i++) {
         uint8_t name[256], str_value[256], type_str[256];
         int value;
         if (avio_tell(bc) >= maxpos)
             return AVERROR_INVALIDDATA;
-        get_str(bc, name, sizeof(name));
+        ret = get_str(bc, name, sizeof(name));
+        if (ret < 0) {
+            av_log(s, AV_LOG_ERROR, "get_str failed while reading sm data\n");
+            return ret;
+        }
         value = get_s(bc);
 
         if (value == -1) {
-- 
2.1.4


_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-devel