Up until now, webm_dash_manifest_cues used the return values of
ebml_read_num and ebml_read_length without checking for errors,
i.e. return values < 0. This has been changed.
Signed-off-by: Andreas Rheinhardt <andreas.rheinha...@gmail.com>
---
libavformat/matroskadec.c | 17 +++++++++++------
1 file changed, 11 insertions(+), 6 deletions(-)
diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c
index 34bc86f25f..0f7decb212 100644
--- a/libavformat/matroskadec.c
+++ b/libavformat/matroskadec.c
@@ -3931,12 +3931,17 @@ static int webm_dash_manifest_cues(AVFormatContext *s,
int64_t init_range)
cues_start = seekhead[i].pos + matroska->segment_start;
if (avio_seek(matroska->ctx->pb, cues_start, SEEK_SET) == cues_start) {
// cues_end is computed as cues_start + cues_length + length of the
- // Cues element ID + EBML length of the Cues element. cues_end is
- // inclusive and the above sum is reduced by 1.
- uint64_t cues_length = 0, cues_id = 0, bytes_read = 0;
- bytes_read += ebml_read_num(matroska, matroska->ctx->pb, 4, &cues_id);
- bytes_read += ebml_read_length(matroska, matroska->ctx->pb,
&cues_length);
- cues_end = cues_start + cues_length + bytes_read - 1;
+ // Cues element ID (i.e. 4) + EBML length of the Cues element.
+ // cues_end is inclusive and the above sum is reduced by 1.
+ uint64_t cues_length, cues_id;
+ int bytes_read;
+ bytes_read = ebml_read_num (matroska, matroska->ctx->pb, 4,
&cues_id);
+ if (bytes_read < 0 || cues_id != (MATROSKA_ID_CUES & 0xfffffff))
+ return bytes_read < 0 ? bytes_read : AVERROR_INVALIDDATA;
+ bytes_read = ebml_read_length(matroska, matroska->ctx->pb,
&cues_length);
+ if (bytes_read < 0)
+ return bytes_read;
+ cues_end = cues_start + 4 + bytes_read + cues_length - 1;
}
avio_seek(matroska->ctx->pb, before_pos, SEEK_SET);
if (cues_start == -1 || cues_end == -1) return -1;
--
2.21.0
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
