comparison utils.c @ 2422:18b8b2dcc037 libavcodec

various security fixes and precautionary checks
author michael
date Wed, 12 Jan 2005 00:16:25 +0000
parents 82af834636c2
children 87b7fbed8609
comparison
equal deleted inserted replaced
2421:e326490f58c4 2422:18b8b2dcc037
80 void *av_fast_realloc(void *ptr, unsigned int *size, unsigned int min_size) 80 void *av_fast_realloc(void *ptr, unsigned int *size, unsigned int min_size)
81 { 81 {
82 if(min_size < *size) 82 if(min_size < *size)
83 return ptr; 83 return ptr;
84 84
85 *size= 17*min_size/16 + 32; 85 *size= FFMAX(17*min_size/16 + 32, min_size);
86 86
87 return av_realloc(ptr, *size); 87 return av_realloc(ptr, *size);
88 } 88 }
89 89
90 90
99 { 99 {
100 void *ptr = av_mallocz(size); 100 void *ptr = av_mallocz(size);
101 101
102 if(ptr){ 102 if(ptr){
103 array_static =av_fast_realloc(array_static, &allocated_static, sizeof(void*)*(last_static+1)); 103 array_static =av_fast_realloc(array_static, &allocated_static, sizeof(void*)*(last_static+1));
104 if(!array_static)
105 return NULL;
104 array_static[last_static++] = ptr; 106 array_static[last_static++] = ptr;
105 } 107 }
106 108
107 return ptr; 109 return ptr;
108 } 110 }
231 233
232 *width = ALIGN(*width , w_align); 234 *width = ALIGN(*width , w_align);
233 *height= ALIGN(*height, h_align); 235 *height= ALIGN(*height, h_align);
234 } 236 }
235 237
238 int avcodec_check_dimensions(void *av_log_ctx, unsigned int w, unsigned int h){
239 if((int)w>0 && (int)h>0 && (w+128)*(uint64_t)(h+128) < INT_MAX/4)
240 return 0;
241
242 av_log(av_log_ctx, AV_LOG_ERROR, "picture size invalid (%ux%u)\n", w, h);
243 return -1;
244 }
245
236 int avcodec_default_get_buffer(AVCodecContext *s, AVFrame *pic){ 246 int avcodec_default_get_buffer(AVCodecContext *s, AVFrame *pic){
237 int i; 247 int i;
238 int w= s->width; 248 int w= s->width;
239 int h= s->height; 249 int h= s->height;
240 InternalBuffer *buf; 250 InternalBuffer *buf;
241 int *picture_number; 251 int *picture_number;
242 252
243 assert(pic->data[0]==NULL); 253 assert(pic->data[0]==NULL);
244 assert(INTERNAL_BUFFER_SIZE > s->internal_buffer_count); 254 assert(INTERNAL_BUFFER_SIZE > s->internal_buffer_count);
255
256 if(avcodec_check_dimensions(s,w,h))
257 return -1;
245 258
246 if(s->internal_buffer==NULL){ 259 if(s->internal_buffer==NULL){
247 s->internal_buffer= av_mallocz(INTERNAL_BUFFER_SIZE*sizeof(InternalBuffer)); 260 s->internal_buffer= av_mallocz(INTERNAL_BUFFER_SIZE*sizeof(InternalBuffer));
248 } 261 }
249 #if 0 262 #if 0
507 if(avctx->coded_width && avctx->coded_height) 520 if(avctx->coded_width && avctx->coded_height)
508 avcodec_set_dimensions(avctx, avctx->coded_width, avctx->coded_height); 521 avcodec_set_dimensions(avctx, avctx->coded_width, avctx->coded_height);
509 else if(avctx->width && avctx->height) 522 else if(avctx->width && avctx->height)
510 avcodec_set_dimensions(avctx, avctx->width, avctx->height); 523 avcodec_set_dimensions(avctx, avctx->width, avctx->height);
511 524
525 if((avctx->coded_width||avctx->coded_height) && avcodec_check_dimensions(avctx,avctx->coded_width,avctx->coded_height)){
526 av_freep(&avctx->priv_data);
527 return -1;
528 }
529
512 ret = avctx->codec->init(avctx); 530 ret = avctx->codec->init(avctx);
513 if (ret < 0) { 531 if (ret < 0) {
514 av_freep(&avctx->priv_data); 532 av_freep(&avctx->priv_data);
515 return ret; 533 return ret;
516 } 534 }
518 } 536 }
519 537
520 int avcodec_encode_audio(AVCodecContext *avctx, uint8_t *buf, int buf_size, 538 int avcodec_encode_audio(AVCodecContext *avctx, uint8_t *buf, int buf_size,
521 const short *samples) 539 const short *samples)
522 { 540 {
541 if(buf_size < FF_MIN_BUFFER_SIZE && 0){
542 av_log(avctx, AV_LOG_ERROR, "buffer smaller then minimum size\n");
543 return -1;
544 }
523 if((avctx->codec->capabilities & CODEC_CAP_DELAY) || samples){ 545 if((avctx->codec->capabilities & CODEC_CAP_DELAY) || samples){
524 int ret = avctx->codec->encode(avctx, buf, buf_size, (void *)samples); 546 int ret = avctx->codec->encode(avctx, buf, buf_size, (void *)samples);
525 avctx->frame_number++; 547 avctx->frame_number++;
526 return ret; 548 return ret;
527 }else 549 }else
529 } 551 }
530 552
531 int avcodec_encode_video(AVCodecContext *avctx, uint8_t *buf, int buf_size, 553 int avcodec_encode_video(AVCodecContext *avctx, uint8_t *buf, int buf_size,
532 const AVFrame *pict) 554 const AVFrame *pict)
533 { 555 {
556 if(buf_size < FF_MIN_BUFFER_SIZE){
557 av_log(avctx, AV_LOG_ERROR, "buffer smaller then minimum size\n");
558 return -1;
559 }
560 if(avcodec_check_dimensions(avctx,avctx->width,avctx->height))
561 return -1;
534 if((avctx->codec->capabilities & CODEC_CAP_DELAY) || pict){ 562 if((avctx->codec->capabilities & CODEC_CAP_DELAY) || pict){
535 int ret = avctx->codec->encode(avctx, buf, buf_size, (void *)pict); 563 int ret = avctx->codec->encode(avctx, buf, buf_size, (void *)pict);
536 avctx->frame_number++; 564 avctx->frame_number++;
537 emms_c(); //needed to avoid a emms_c() call before every return; 565 emms_c(); //needed to avoid a emms_c() call before every return;
538 566
555 uint8_t *buf, int buf_size) 583 uint8_t *buf, int buf_size)
556 { 584 {
557 int ret; 585 int ret;
558 586
559 *got_picture_ptr= 0; 587 *got_picture_ptr= 0;
588 if((avctx->coded_width||avctx->coded_height) && avcodec_check_dimensions(avctx,avctx->coded_width,avctx->coded_height))
589 return -1;
560 ret = avctx->codec->decode(avctx, picture, got_picture_ptr, 590 ret = avctx->codec->decode(avctx, picture, got_picture_ptr,
561 buf, buf_size); 591 buf, buf_size);
562 592
563 emms_c(); //needed to avoid a emms_c() call before every return; 593 emms_c(); //needed to avoid a emms_c() call before every return;
564 594