On Sun, Jan 28, 2018 at 12:01:13AM +0100, Karsten Otto wrote:
> Remember the end position of audio content in the file and check it during
> read_packet. There always seems to be other data beyond it, which could be
> misinterpreted as more audio. Also add some extra avio_read error checks,
> to bail early in case of a broken/truncated file.
> ---
> libavformat/aadec.c | 11 +++++++++--
> 1 file changed, 9 insertions(+), 2 deletions(-)
>
> diff --git a/libavformat/aadec.c b/libavformat/aadec.c
> index 8d39b1d9ba..d6b6c125da 100644
> --- a/libavformat/aadec.c
> +++ b/libavformat/aadec.c
> @@ -46,6 +46,7 @@ typedef struct AADemuxContext {
> struct AVTEA *tea_ctx;
> uint8_t file_key[16];
> int64_t current_chapter_size;
> + int64_t content_end;
> } AADemuxContext;
>
> static int get_second_size(char *codec_name)
> @@ -197,6 +198,7 @@ static int aa_read_header(AVFormatContext *s)
> }
> start = TOC[largest_idx].offset;
> avio_seek(pb, start, SEEK_SET);
> + c->content_end = start + largest_size;
> c->current_chapter_size = 0;
>
> return 0;
> @@ -214,6 +216,11 @@ static int aa_read_packet(AVFormatContext *s, AVPacket
> *pkt)
> int ret;
> AADemuxContext *c = s->priv_data;
>
> + // are we at the end of the audio content?
> + if (avio_tell(s->pb) >= c->content_end) {
> + return AVERROR_EOF;
> + }
> +
> // are we at the start of a chapter?
> if (c->current_chapter_size == 0) {
> c->current_chapter_size = avio_rb32(s->pb);
> @@ -234,7 +241,7 @@ static int aa_read_packet(AVFormatContext *s, AVPacket
> *pkt)
> // decrypt c->current_codec_second_size bytes
> blocks = c->current_codec_second_size / TEA_BLOCK_SIZE;
> for (i = 0; i < blocks; i++) {
> - avio_read(s->pb, src, TEA_BLOCK_SIZE);
> + if (avio_read(s->pb, src, TEA_BLOCK_SIZE) < 0) return AVERROR_EOF;I suspect this should forward the error code or the test should be for != TEA_BLOCK_SIZE [...] -- Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB Does the universe only have a finite lifespan? No, its going to go on forever, its just that you wont like living in it. -- Hiranya Peiri
signature.asc
Description: PGP signature
_______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org http://ffmpeg.org/mailman/listinfo/ffmpeg-devel
