Browse code

nutdec: abort if EOF is reached in decode_info_header/read_sm_data

These loops can take a lot of time if count is very large.

Reviewed-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit bb23a15df507440deb0dcf25099d321d0f73dc28)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Andreas Cadhalpun authored on 2015/05/20 07:34:42
Showing 1 changed files
... ...
@@ -492,7 +492,7 @@ static int decode_info_header(NUTContext *nut)
492 492
     AVIOContext *bc    = s->pb;
493 493
     uint64_t tmp, chapter_start, chapter_len;
494 494
     unsigned int stream_id_plus1, count;
495
-    int chapter_id, i;
495
+    int chapter_id, i, ret;
496 496
     int64_t value, end;
497 497
     char name[256], str_value[1024], type_str[256];
498 498
     const char *type;
... ...
@@ -534,7 +534,11 @@ static int decode_info_header(NUTContext *nut)
534 534
     }
535 535
 
536 536
     for (i = 0; i < count; i++) {
537
-        get_str(bc, name, sizeof(name));
537
+        ret = get_str(bc, name, sizeof(name));
538
+        if (ret < 0) {
539
+            av_log(s, AV_LOG_ERROR, "get_str failed while decoding info header\n");
540
+            return ret;
541
+        }
538 542
         value = get_s(bc);
539 543
         str_value[0] = 0;
540 544
 
... ...
@@ -845,14 +849,18 @@ static int read_sm_data(AVFormatContext *s, AVIOContext *bc, AVPacket *pkt, int
845 845
     int sample_rate = 0;
846 846
     int width = 0;
847 847
     int height = 0;
848
-    int i;
848
+    int i, ret;
849 849
 
850 850
     for (i=0; i<count; i++) {
851 851
         uint8_t name[256], str_value[256], type_str[256];
852 852
         int value;
853 853
         if (avio_tell(bc) >= maxpos)
854 854
             return AVERROR_INVALIDDATA;
855
-        get_str(bc, name, sizeof(name));
855
+        ret = get_str(bc, name, sizeof(name));
856
+        if (ret < 0) {
857
+            av_log(s, AV_LOG_ERROR, "get_str failed while reading sm data\n");
858
+            return ret;
859
+        }
856 860
         value = get_s(bc);
857 861
 
858 862
         if (value == -1) {