101 lines
3.0 KiB
Diff
101 lines
3.0 KiB
Diff
gst-ffmpeg: Security Advisory - ffmpeg - CVE-2013-0855
|
|
|
|
Upstream-Status: Backport
|
|
|
|
Signed-off-by: Yue Tao <yue.tao@windriver.com>
|
|
|
|
diff --git a/gst-libs/ext/libav/libavcodec/alac.c.old b/gst-libs/ext/libav/libavcodec/alac.c
|
|
index 2a0df8c..bcbd56d 100644
|
|
--- a/gst-libs/ext/libav/libavcodec/alac.c.old
|
|
+++ b/gst-libs/ext/libav/libavcodec/alac.c
|
|
@@ -87,18 +87,44 @@ typedef struct {
|
|
int wasted_bits;
|
|
} ALACContext;
|
|
|
|
-static void allocate_buffers(ALACContext *alac)
|
|
+static av_cold int alac_decode_close(AVCodecContext *avctx)
|
|
+{
|
|
+ ALACContext *alac = avctx->priv_data;
|
|
+
|
|
+ int chan;
|
|
+ for (chan = 0; chan < MAX_CHANNELS; chan++) {
|
|
+ av_freep(&alac->predicterror_buffer[chan]);
|
|
+ av_freep(&alac->outputsamples_buffer[chan]);
|
|
+ av_freep(&alac->wasted_bits_buffer[chan]);
|
|
+ }
|
|
+
|
|
+ return 0;
|
|
+}
|
|
+
|
|
+static int allocate_buffers(ALACContext *alac)
|
|
{
|
|
int chan;
|
|
+ int buf_size;
|
|
+
|
|
+ if (alac->setinfo_max_samples_per_frame > INT_MAX / sizeof(int32_t))
|
|
+ goto buf_alloc_fail;
|
|
+ buf_size = alac->setinfo_max_samples_per_frame * sizeof(int32_t);
|
|
+
|
|
for (chan = 0; chan < MAX_CHANNELS; chan++) {
|
|
- alac->predicterror_buffer[chan] =
|
|
- av_malloc(alac->setinfo_max_samples_per_frame * 4);
|
|
|
|
- alac->outputsamples_buffer[chan] =
|
|
- av_malloc(alac->setinfo_max_samples_per_frame * 4);
|
|
+ FF_ALLOC_OR_GOTO(alac->avctx, alac->predicterror_buffer[chan],
|
|
+ buf_size, buf_alloc_fail);
|
|
|
|
- alac->wasted_bits_buffer[chan] = av_malloc(alac->setinfo_max_samples_per_frame * 4);
|
|
+ FF_ALLOC_OR_GOTO(alac->avctx, alac->outputsamples_buffer[chan],
|
|
+ buf_size, buf_alloc_fail);
|
|
+
|
|
+ FF_ALLOC_OR_GOTO(alac->avctx, alac->wasted_bits_buffer[chan],
|
|
+ buf_size, buf_alloc_fail);
|
|
}
|
|
+ return 0;
|
|
+buf_alloc_fail:
|
|
+ alac_decode_close(alac->avctx);
|
|
+ return AVERROR(ENOMEM);
|
|
}
|
|
|
|
static int alac_set_info(ALACContext *alac)
|
|
@@ -131,8 +157,6 @@ static int alac_set_info(ALACContext *alac)
|
|
bytestream_get_be32(&ptr); /* bitrate ? */
|
|
bytestream_get_be32(&ptr); /* samplerate */
|
|
|
|
- allocate_buffers(alac);
|
|
-
|
|
return 0;
|
|
}
|
|
|
|
@@ -659,6 +683,7 @@ static int alac_decode_frame(AVCodecContext *avctx,
|
|
|
|
static av_cold int alac_decode_init(AVCodecContext * avctx)
|
|
{
|
|
+ int ret;
|
|
ALACContext *alac = avctx->priv_data;
|
|
alac->avctx = avctx;
|
|
alac->numchannels = alac->avctx->channels;
|
|
@@ -674,18 +699,9 @@ static av_cold int alac_decode_init(AVCodecContext * avctx)
|
|
return -1;
|
|
}
|
|
|
|
- return 0;
|
|
-}
|
|
-
|
|
-static av_cold int alac_decode_close(AVCodecContext *avctx)
|
|
-{
|
|
- ALACContext *alac = avctx->priv_data;
|
|
-
|
|
- int chan;
|
|
- for (chan = 0; chan < MAX_CHANNELS; chan++) {
|
|
- av_freep(&alac->predicterror_buffer[chan]);
|
|
- av_freep(&alac->outputsamples_buffer[chan]);
|
|
- av_freep(&alac->wasted_bits_buffer[chan]);
|
|
+ if ((ret = allocate_buffers(alac)) < 0) {
|
|
+ av_log(avctx, AV_LOG_ERROR, "Error allocating buffers\n");
|
|
+ return ret;
|
|
}
|
|
|
|
return 0;
|