summaryrefslogtreecommitdiff
path: root/src/demuxers
diff options
context:
space:
mode:
Diffstat (limited to 'src/demuxers')
-rw-r--r--src/demuxers/asfheader.c4
-rw-r--r--src/demuxers/demux_asf.c13
-rw-r--r--src/demuxers/demux_avi.c8
-rw-r--r--src/demuxers/demux_matroska.c24
-rw-r--r--src/demuxers/demux_mng.c4
-rw-r--r--src/demuxers/demux_mod.c8
-rw-r--r--src/demuxers/demux_real.c29
-rw-r--r--src/demuxers/demux_realaudio.c2
-rw-r--r--src/demuxers/id3.h12
-rw-r--r--src/demuxers/iff.h4
10 files changed, 72 insertions, 36 deletions
diff --git a/src/demuxers/asfheader.c b/src/demuxers/asfheader.c
index ebc739073..9639ea4f7 100644
--- a/src/demuxers/asfheader.c
+++ b/src/demuxers/asfheader.c
@@ -540,12 +540,12 @@ static int asf_header_parse_metadata(asf_header_t *header_pub, uint8_t *buffer,
if (data_len >= 4)
{
char *name = asf_reader_get_string (&reader, name_len, iconv_cd);
- if (!strcmp (name, "AspectRatioX"))
+ if (name && !strcmp (name, "AspectRatioX"))
{
asf_reader_get_32 (&reader, &header->pub.aspect_ratios[stream_id].x);
data_len -= 4;
}
- else if (!strcmp (name, "AspectRatioY"))
+ else if (name && !strcmp (name, "AspectRatioY"))
{
asf_reader_get_32 (&reader, &header->pub.aspect_ratios[stream_id].y);
data_len -= 4;
diff --git a/src/demuxers/demux_asf.c b/src/demuxers/demux_asf.c
index e361579b0..ff2d1e6a8 100644
--- a/src/demuxers/demux_asf.c
+++ b/src/demuxers/demux_asf.c
@@ -70,6 +70,7 @@
#define ASF_MODE_HTTP_REF 2
#define ASF_MODE_ASF_REF 3
#define ASF_MODE_ENCRYPTED_CONTENT 4
+#define ASF_MODE_NO_CONTENT 5
typedef struct {
int seq;
@@ -443,6 +444,17 @@ static int asf_read_header (demux_asf_t *this) {
asf_stream_t *asf_stream = this->asf_header->streams[i];
asf_demux_stream_t *demux_stream = &this->streams[i];
+ if (!asf_stream) {
+ if (this->mode != ASF_MODE_NO_CONTENT) {
+ xine_log(this->stream->xine, XINE_LOG_MSG,
+ _("demux_asf: warning: A stream appears to be missing.\n"));
+ _x_message(this->stream, XINE_MSG_READ_ERROR,
+ _("Media stream missing?"), NULL);
+ this->mode = ASF_MODE_NO_CONTENT;
+ }
+ return 0;
+ }
+
if (asf_stream->encrypted_flag) {
if (this->mode != ASF_MODE_ENCRYPTED_CONTENT) {
xine_log(this->stream->xine, XINE_LOG_MSG,
@@ -1675,6 +1687,7 @@ static int demux_asf_send_chunk (demux_plugin_t *this_gen) {
return demux_asf_parse_asf_references(this);
case ASF_MODE_ENCRYPTED_CONTENT:
+ case ASF_MODE_NO_CONTENT:
this->status = DEMUX_FINISHED;
return this->status;
diff --git a/src/demuxers/demux_avi.c b/src/demuxers/demux_avi.c
index 0f1735f96..3c1c8491a 100644
--- a/src/demuxers/demux_avi.c
+++ b/src/demuxers/demux_avi.c
@@ -317,6 +317,8 @@ typedef struct {
getIndex==0, but an operation has been
performed that needs an index */
+#define AVI_ERR_BAD_SIZE 14 /* A chunk has an invalid size */
+
#define AVI_HEADER_UNKNOWN -1
#define AVI_HEADER_AUDIO 0
#define AVI_HEADER_VIDEO 1
@@ -780,7 +782,7 @@ static avi_t *XINE_MALLOC AVI_init(demux_avi_t *this) {
lprintf("chunk: %c%c%c%c, size: %" PRId64 "\n",
data[0], data[1], data[2], data[3], (int64_t)n);
- if((strncasecmp(data,"LIST",4) == 0) && (n >= 4)) {
+ if (n >= 4 && strncasecmp(data,"LIST",4) == 0) {
if( this->input->read(this->input, data,4) != 4 ) ERR_EXIT(AVI_ERR_READ);
n -= 4;
@@ -835,6 +837,8 @@ static avi_t *XINE_MALLOC AVI_init(demux_avi_t *this) {
/* Interpret the header list */
for (i = 0; i < hdrl_len;) {
+ const int old_i = i;
+
/* List tags are completly ignored */
lprintf("tag: %c%c%c%c\n",
hdrl_data[i], hdrl_data[i+1], hdrl_data[i+2], hdrl_data[i+3]);
@@ -1081,6 +1085,8 @@ static avi_t *XINE_MALLOC AVI_init(demux_avi_t *this) {
lasttag = 0;
}
i += n;
+ if (i <= old_i)
+ ERR_EXIT(AVI_ERR_BAD_SIZE);
}
if( hdrl_data )
diff --git a/src/demuxers/demux_matroska.c b/src/demuxers/demux_matroska.c
index b0919036f..9bba40155 100644
--- a/src/demuxers/demux_matroska.c
+++ b/src/demuxers/demux_matroska.c
@@ -106,7 +106,7 @@ typedef struct {
/* block */
uint8_t *block_data;
- int block_data_size;
+ size_t block_data_size;
/* current tracks */
matroska_track_t *video_track; /* to remove */
@@ -875,7 +875,7 @@ static void init_codec_vobsub(demux_matroska_t *this,
static void handle_realvideo (demux_plugin_t *this_gen, matroska_track_t *track,
int decoder_flags,
- uint8_t *data, int data_len,
+ uint8_t *data, size_t data_len,
int64_t data_pts, int data_duration,
int input_normpos, int input_time) {
demux_matroska_t *this = (demux_matroska_t *) this_gen;
@@ -924,7 +924,7 @@ static void handle_realvideo (demux_plugin_t *this_gen, matroska_track_t *track,
static void handle_sub_ssa (demux_plugin_t *this_gen, matroska_track_t *track,
int decoder_flags,
- uint8_t *data, int data_len,
+ uint8_t *data, size_t data_len,
int64_t data_pts, int data_duration,
int input_normpos, int input_time) {
buf_element_t *buf;
@@ -999,7 +999,7 @@ static void handle_sub_ssa (demux_plugin_t *this_gen, matroska_track_t *track,
static void handle_sub_utf8 (demux_plugin_t *this_gen, matroska_track_t *track,
int decoder_flags,
- uint8_t *data, int data_len,
+ uint8_t *data, size_t data_len,
int64_t data_pts, int data_duration,
int input_normpos, int input_time) {
demux_matroska_t *this = (demux_matroska_t *) this_gen;
@@ -1046,7 +1046,7 @@ static void handle_sub_utf8 (demux_plugin_t *this_gen, matroska_track_t *track,
*/
static void handle_vobsub (demux_plugin_t *this_gen, matroska_track_t *track,
int decoder_flags,
- uint8_t *data, int data_len,
+ uint8_t *data, size_t data_len,
int64_t data_pts, int data_duration,
int input_normpos, int input_time) {
demux_matroska_t *this = (demux_matroska_t *) this_gen;
@@ -1735,7 +1735,7 @@ static int parse_tags(demux_matroska_t *this) {
return 1;
}
-static void alloc_block_data (demux_matroska_t *this, int len) {
+static void alloc_block_data (demux_matroska_t *this, size_t len) {
/* memory management */
if (this->block_data_size < len) {
this->block_data = realloc(this->block_data, len);
@@ -1804,7 +1804,7 @@ static int find_track_by_id(demux_matroska_t *this, int track_num,
}
-static int read_block_data (demux_matroska_t *this, int len) {
+static int read_block_data (demux_matroska_t *this, size_t len) {
alloc_block_data(this, len);
/* block datas */
@@ -1827,7 +1827,7 @@ static int parse_int16(uint8_t *data) {
return value;
}
-static int parse_block (demux_matroska_t *this, uint64_t block_size,
+static int parse_block (demux_matroska_t *this, size_t block_size,
uint64_t cluster_timecode, uint64_t block_duration,
int normpos, int is_key) {
matroska_track_t *track;
@@ -1893,7 +1893,7 @@ static int parse_block (demux_matroska_t *this, uint64_t block_size,
}
if (lacing == MATROSKA_NO_LACING) {
- int block_size_left;
+ size_t block_size_left;
lprintf("no lacing\n");
block_size_left = (this->block_data + block_size) - data;
@@ -1913,9 +1913,9 @@ static int parse_block (demux_matroska_t *this, uint64_t block_size,
}
} else {
- int block_size_left;
+ size_t block_size_left;
uint8_t lace_num;
- int frame[MAX_FRAMES];
+ size_t frame[MAX_FRAMES];
int i;
/* number of laced frames */
@@ -2056,7 +2056,7 @@ static int parse_block_group(demux_matroska_t *this,
off_t block_pos = 0;
off_t file_len = 0;
int normpos = 0;
- int block_len = 0;
+ size_t block_len = 0;
int is_key = 1;
while (next_level == 3) {
diff --git a/src/demuxers/demux_mng.c b/src/demuxers/demux_mng.c
index f54245744..499811d54 100644
--- a/src/demuxers/demux_mng.c
+++ b/src/demuxers/demux_mng.c
@@ -116,7 +116,9 @@ static mng_bool mymng_process_header(mng_handle mngh, mng_uint32 width, mng_uint
this->bih.biHeight = height;
this->left_edge = (this->bih.biWidth - width) / 2;
- this->image = malloc(this->bih.biWidth * height * 3);
+ this->image = malloc((mng_size_t)this->bih.biWidth * (mng_size_t)height * 3);
+ if (!this->image)
+ return MNG_FALSE;
mng_set_canvasstyle(mngh, MNG_CANVAS_RGB8);
diff --git a/src/demuxers/demux_mod.c b/src/demuxers/demux_mod.c
index c424ffc81..ab5157531 100644
--- a/src/demuxers/demux_mod.c
+++ b/src/demuxers/demux_mod.c
@@ -70,7 +70,7 @@ typedef struct {
char *title;
char *artist;
char *copyright;
- off_t filesize;
+ size_t filesize;
char *buffer;
@@ -131,7 +131,11 @@ static int open_mod_file(demux_mod_t *this) {
/* Get size and create buffer */
this->filesize = this->input->get_length(this->input);
this->buffer = (char *)malloc(this->filesize);
-
+ if(!this->buffer) {
+ xine_log(this->stream->xine, XINE_LOG_PLUGIN, "modplug - allocation failure\n");
+ return 0;
+ }
+
/* Seek to beginning */
this->input->seek(this->input, 0, SEEK_SET);
diff --git a/src/demuxers/demux_real.c b/src/demuxers/demux_real.c
index 105dc60a5..00e5f49fe 100644
--- a/src/demuxers/demux_real.c
+++ b/src/demuxers/demux_real.c
@@ -90,11 +90,11 @@ typedef struct {
uint32_t start_time;
uint32_t preroll;
uint32_t duration;
- char stream_name_size;
+ size_t stream_name_size;
char *stream_name;
- char mime_type_size;
+ size_t mime_type_size;
char *mime_type;
- uint32_t type_specific_len;
+ size_t type_specific_len;
char *type_specific_data;
} mdpr_t;
@@ -115,7 +115,7 @@ typedef struct {
mdpr_t *mdpr;
int sps, cfs, w, h;
int block_align;
- int frame_size;
+ size_t frame_size;
uint8_t *frame_buffer;
uint32_t frame_num_bytes;
uint32_t sub_packet_cnt;
@@ -359,8 +359,12 @@ static void real_parse_audio_specific_data (demux_real_t *this,
stream->frame_num_bytes = 0;
stream->sub_packet_cnt = 0;
+ if (!stream->frame_buffer)
+ xprintf (this->stream->xine, XINE_VERBOSITY_LOG,
+ "demux_real: failed to allocate the audio frame buffer!\n");
+
xprintf (this->stream->xine, XINE_VERBOSITY_LOG,
- "demux_real: buf type 0x%08x frame size %dblock align %d\n", stream->buf_type,
+ "demux_real: buf type 0x%08x frame size %zu block align %d\n", stream->buf_type,
stream->frame_size, stream->block_align);
}
@@ -1370,13 +1374,20 @@ static int demux_real_send_chunk(demux_plugin_t *this_gen) {
int cfs = this->audio_stream->cfs;
int w = this->audio_stream->w;
int spc = this->audio_stream->sub_packet_cnt;
- int x, pos;
+ int x;
+ off_t pos;
+ const size_t fs = this->audio_stream->frame_size;
+
+ if (!buffer) {
+ this->status = DEMUX_FINISHED;
+ return this->status;
+ }
switch (this->audio_stream->buf_type) {
case BUF_AUDIO_28_8:
for (x = 0; x < sph / 2; x++) {
pos = x * 2 * w + spc * cfs;
- if(this->input->read(this->input, buffer + pos, cfs) < cfs) {
+ if(pos + cfs > fs || this->input->read(this->input, buffer + pos, cfs) < cfs) {
xprintf(this->stream->xine, XINE_VERBOSITY_DEBUG,
"demux_real: failed to read audio chunk\n");
@@ -1389,7 +1400,7 @@ static int demux_real_send_chunk(demux_plugin_t *this_gen) {
case BUF_AUDIO_ATRK:
for (x = 0; x < w / sps; x++) {
pos = sps * (sph * x + ((sph + 1) / 2) * (spc & 1) + (spc >> 1));
- if(this->input->read(this->input, buffer + pos, sps) < sps) {
+ if(pos + sps > fs || this->input->read(this->input, buffer + pos, sps) < sps) {
xprintf(this->stream->xine, XINE_VERBOSITY_DEBUG,
"demux_real: failed to read audio chunk\n");
@@ -1400,7 +1411,7 @@ static int demux_real_send_chunk(demux_plugin_t *this_gen) {
break;
case BUF_AUDIO_SIPRO:
pos = spc * w;
- if(this->input->read(this->input, buffer + pos, w) < w) {
+ if(pos + w > fs || this->input->read(this->input, buffer + pos, w) < w) {
xprintf(this->stream->xine, XINE_VERBOSITY_DEBUG,
"demux_real: failed to read audio chunk\n");
diff --git a/src/demuxers/demux_realaudio.c b/src/demuxers/demux_realaudio.c
index 1040d42bc..75c20d61f 100644
--- a/src/demuxers/demux_realaudio.c
+++ b/src/demuxers/demux_realaudio.c
@@ -67,7 +67,7 @@ typedef struct {
uint32_t cfs;
uint16_t w, h;
int frame_len;
- int frame_size;
+ size_t frame_size;
uint8_t *frame_buffer;
unsigned char *header;
diff --git a/src/demuxers/id3.h b/src/demuxers/id3.h
index 837d8243f..d69642f4a 100644
--- a/src/demuxers/id3.h
+++ b/src/demuxers/id3.h
@@ -104,22 +104,22 @@ typedef struct {
uint32_t id;
uint8_t revision;
uint8_t flags;
- uint32_t size;
+ size_t size;
} id3v2_header_t;
typedef struct {
uint32_t id;
- uint32_t size;
+ size_t size;
} id3v22_frame_header_t;
typedef struct {
uint32_t id;
- uint32_t size;
+ size_t size;
uint16_t flags;
} id3v23_frame_header_t;
typedef struct {
- uint32_t size;
+ size_t size;
uint16_t flags;
uint32_t padding_size;
uint32_t crc;
@@ -129,12 +129,12 @@ typedef id3v2_header_t id3v24_footer_t;
typedef struct {
uint32_t id;
- uint32_t size;
+ size_t size;
uint16_t flags;
} id3v24_frame_header_t;
typedef struct {
- uint32_t size;
+ size_t size;
uint8_t flags;
uint32_t crc;
uint8_t restrictions;
diff --git a/src/demuxers/iff.h b/src/demuxers/iff.h
index fcfc54f16..921963c08 100644
--- a/src/demuxers/iff.h
+++ b/src/demuxers/iff.h
@@ -27,8 +27,8 @@
#define IFFP_IFF_H
#define IFF_OKAY 0L
-#define CLIENT_ERROR 1L
-#define NOFILE 5L
+#define IFF_CLIENT_ERROR 1L
+#define IFF_NOFILE 5L
#define FOURCC_CHUNK BE_FOURCC
#define IFF_16SV_CHUNK FOURCC_CHUNK('1', '6', 'S', 'V')
generated by cgit v1.2.3 (git 2.25.1) at 2025-10-08 18:14:48 +0000