mirrors/gstreamer
mirrors/gstreamer
1
1
Fork 0
mirror of https://gitlab.freedesktop.org/gstreamer/gstreamer.git synced 2025-01-31 19:42:26 +00:00
Code Issues 1 Projects Releases Wiki Activity

[MOVED FROM BAD 41/57] gst/flv/gstflvparse.c: Properly check everywhere that we have enough data to parse and don't read outside the allocat...

Browse source 
Original commit message from CVS:
* gst/flv/gstflvparse.c: (FLV_GET_STRING),
(gst_flv_parse_tag_audio), (gst_flv_parse_tag_video),
(gst_flv_parse_tag_type), (gst_flv_parse_header):
Properly check everywhere that we have enough data to parse and
don't read outside the allocated memory region.
This commit is contained in:
Sebastian Dröge 2008-10-27 09:37:21 +00:00 committed by Sebastian Dröge
parent 4aa480725c
commit ab136d52eb
1 changed files with 21 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

22
gst/flv/gstflvparse.c
View file

@ -48,7 +48,7 @@ FLV_GET_STRING (const guint8 * data, size_t data_size)
g_return_val_if_fail (data_size >= 2, NULL); g_return_val_if_fail (data_size >= 2, NULL);
string_size = GST_READ_UINT16_BE (data); string_size = GST_READ_UINT16_BE (data);
if (G_UNLIKELY (string_size > data_size)) { if (G_UNLIKELY (string_size > data_size - 2)) {
return NULL; return NULL;
} }
@ -504,6 +504,8 @@ gst_flv_parse_tag_audio (GstFLVDemux * demux, const guint8 * data,
GST_LOG_OBJECT (demux, "parsing an audio tag"); GST_LOG_OBJECT (demux, "parsing an audio tag");
g_return_val_if_fail (data_size == demux->tag_size, GST_FLOW_ERROR);
GST_LOG_OBJECT (demux, "pts bytes %02X %02X %02X %02X", data[0], data[1], GST_LOG_OBJECT (demux, "pts bytes %02X %02X %02X %02X", data[0], data[1],
data[2], data[3]); data[2], data[3]);
@ -513,6 +515,12 @@ gst_flv_parse_tag_audio (GstFLVDemux * demux, const guint8 * data,
pts_ext = GST_READ_UINT8 (data + 3); pts_ext = GST_READ_UINT8 (data + 3);
/* Combine them */ /* Combine them */
pts |= pts_ext << 24; pts |= pts_ext << 24;
if (data_size < 12) {
GST_ERROR_OBJECT (demux, "Too small tag size");
return GST_FLOW_ERROR;
}
/* Skip the stream id and go directly to the flags */ /* Skip the stream id and go directly to the flags */
flags = GST_READ_UINT8 (data + 7); flags = GST_READ_UINT8 (data + 7);
@ -826,6 +834,8 @@ gst_flv_parse_tag_video (GstFLVDemux * demux, const guint8 * data,
gboolean keyframe = FALSE; gboolean keyframe = FALSE;
guint8 flags = 0, codec_tag = 0; guint8 flags = 0, codec_tag = 0;
g_return_val_if_fail (data_size == demux->tag_size, GST_FLOW_ERROR);
GST_LOG_OBJECT (demux, "parsing a video tag"); GST_LOG_OBJECT (demux, "parsing a video tag");
GST_LOG_OBJECT (demux, "pts bytes %02X %02X %02X %02X", data[0], data[1], GST_LOG_OBJECT (demux, "pts bytes %02X %02X %02X %02X", data[0], data[1],
@ -837,6 +847,12 @@ gst_flv_parse_tag_video (GstFLVDemux * demux, const guint8 * data,
pts_ext = GST_READ_UINT8 (data + 3); pts_ext = GST_READ_UINT8 (data + 3);
/* Combine them */ /* Combine them */
pts |= pts_ext << 24; pts |= pts_ext << 24;
if (data_size < 12) {
GST_ERROR_OBJECT (demux, "Too small tag size");
return GST_FLOW_ERROR;
}
/* Skip the stream id and go directly to the flags */ /* Skip the stream id and go directly to the flags */
flags = GST_READ_UINT8 (data + 7); flags = GST_READ_UINT8 (data + 7);
@ -1138,6 +1154,8 @@ gst_flv_parse_tag_type (GstFLVDemux * demux, const guint8 * data,
GstFlowReturn ret = GST_FLOW_OK; GstFlowReturn ret = GST_FLOW_OK;
guint8 tag_type = 0; guint8 tag_type = 0;
g_return_val_if_fail (data_size >= 4, GST_FLOW_ERROR);
tag_type = data[0]; tag_type = data[0];
switch (tag_type) { switch (tag_type) {
@ -1173,6 +1191,8 @@ gst_flv_parse_header (GstFLVDemux * demux, const guint8 * data,
{ {
GstFlowReturn ret = GST_FLOW_OK; GstFlowReturn ret = GST_FLOW_OK;
g_return_val_if_fail (data_size >= 9, GST_FLOW_ERROR);
/* Check for the FLV tag */ /* Check for the FLV tag */
if (data[0] == 'F' && data[1] == 'L' && data[2] == 'V') { if (data[0] == 'F' && data[1] == 'L' && data[2] == 'V') {
GST_DEBUG_OBJECT (demux, "FLV header detected"); GST_DEBUG_OBJECT (demux, "FLV header detected");