1 files changed, 137 insertions, 71 deletions

diff --git a/src/input/libreal/rmff.c b/src/input/libreal/rmff.c
index 159b81ee6..6a2b761e1 100644
--- a/src/input/libreal/rmff.c
+++ b/src/input/libreal/rmff.c
@@ -21,6 +21,10 @@
  * adopted from joschkas real tools
  */
 
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
 #define LOG_MODULE "rmff"
 #define LOG_VERBOSE
 /*
@@ -35,15 +39,19 @@
  * writes header data to a buffer
  */
 
-static void rmff_dump_fileheader(rmff_fileheader_t *fileheader, char *buffer) {
+static int rmff_dump_fileheader(rmff_fileheader_t *fileheader, uint8_t *buffer, int bufsize) {
+
+  if (!fileheader) return 0;
+
+  if (bufsize < RMFF_FILEHEADER_SIZE)
+    return -1;
 
-  if (!fileheader) return;
   fileheader->object_id=_X_BE_32(&fileheader->object_id);
   fileheader->size=_X_BE_32(&fileheader->size);
   fileheader->object_version=_X_BE_16(&fileheader->object_version);
   fileheader->file_version=_X_BE_32(&fileheader->file_version);
   fileheader->num_headers=_X_BE_32(&fileheader->num_headers);
-  
+
   memcpy(buffer, fileheader, 8);
   memcpy(&buffer[8], &fileheader->object_version, 2);
   memcpy(&buffer[10], &fileheader->file_version, 8);
@@ -53,11 +61,17 @@ static void rmff_dump_fileheader(rmff_fileheader_t *fileheader, char *buffer) {
   fileheader->file_version=_X_BE_32(&fileheader->file_version);
   fileheader->num_headers=_X_BE_32(&fileheader->num_headers);
   fileheader->object_id=_X_BE_32(&fileheader->object_id);
+
+  return RMFF_FILEHEADER_SIZE;
 }
 
-static void rmff_dump_prop(rmff_prop_t *prop, char *buffer) {
+static int rmff_dump_prop(rmff_prop_t *prop, uint8_t *buffer, int bufsize) {
+
+  if (!prop) return 0;
+
+  if (bufsize < RMFF_PROPHEADER_SIZE)
+    return -1;
 
-  if (!prop) return;
   prop->object_id=_X_BE_32(&prop->object_id);
   prop->size=_X_BE_32(&prop->size);
   prop->object_version=_X_BE_16(&prop->object_version);
@@ -78,7 +92,7 @@ static void rmff_dump_prop(rmff_prop_t *prop, char *buffer) {
   memcpy(&buffer[10], &prop->max_bit_rate, 36);
   memcpy(&buffer[46], &prop->num_streams, 2);
   memcpy(&buffer[48], &prop->flags, 2);
-  
+
   prop->size=_X_BE_32(&prop->size);
   prop->object_version=_X_BE_16(&prop->object_version);
   prop->max_bit_rate=_X_BE_32(&prop->max_bit_rate);
@@ -93,13 +107,19 @@ static void rmff_dump_prop(rmff_prop_t *prop, char *buffer) {
   prop->num_streams=_X_BE_16(&prop->num_streams);
   prop->flags=_X_BE_16(&prop->flags);
   prop->object_id=_X_BE_32(&prop->object_id);
+
+  return RMFF_PROPHEADER_SIZE;
 }
 
-static void rmff_dump_mdpr(rmff_mdpr_t *mdpr, char *buffer) {
+static int rmff_dump_mdpr(rmff_mdpr_t *mdpr, uint8_t *buffer, int bufsize) {
 
   int s1, s2, s3;
 
-  if (!mdpr) return;
+  if (!mdpr) return 0;
+
+  if (bufsize < RMFF_MDPRHEADER_SIZE + mdpr->type_specific_len + mdpr->stream_name_size + mdpr->mime_type_size)
+    return -1;
+
   mdpr->object_id=_X_BE_32(&mdpr->object_id);
   mdpr->size=_X_BE_32(&mdpr->size);
   mdpr->object_version=_X_BE_16(&mdpr->object_version);
@@ -123,7 +143,7 @@ static void rmff_dump_mdpr(rmff_mdpr_t *mdpr, char *buffer) {
   memcpy(&buffer[41+s1], &mdpr->mime_type_size, 1);
   s2=mdpr->mime_type_size;
   memcpy(&buffer[42+s1], mdpr->mime_type, s2);
-  
+
   mdpr->type_specific_len=_X_BE_32(&mdpr->type_specific_len);
   memcpy(&buffer[42+s1+s2], &mdpr->type_specific_len, 4);
   mdpr->type_specific_len=_X_BE_32(&mdpr->type_specific_len);
@@ -141,20 +161,26 @@ static void rmff_dump_mdpr(rmff_mdpr_t *mdpr, char *buffer) {
   mdpr->duration=_X_BE_32(&mdpr->duration);
   mdpr->object_id=_X_BE_32(&mdpr->object_id);
 
+  return RMFF_MDPRHEADER_SIZE + s1 + s2 + s3;
 }
 
-static void rmff_dump_cont(rmff_cont_t *cont, char *buffer) {
+static int rmff_dump_cont(rmff_cont_t *cont, uint8_t *buffer, int bufsize) {
 
   int p;
 
-  if (!cont) return;
+  if (!cont) return 0;
+
+  if (bufsize < RMFF_CONTHEADER_SIZE + cont->title_len + cont->author_len +
+      cont->copyright_len + cont->comment_len)
+    return -1;
+
   cont->object_id=_X_BE_32(&cont->object_id);
   cont->size=_X_BE_32(&cont->size);
   cont->object_version=_X_BE_16(&cont->object_version);
 
   memcpy(buffer, cont, 8);
   memcpy(&buffer[8], &cont->object_version, 2);
-  
+
   cont->title_len=_X_BE_16(&cont->title_len);
   memcpy(&buffer[10], &cont->title_len, 2);
   cont->title_len=_X_BE_16(&cont->title_len);
@@ -181,11 +207,18 @@ static void rmff_dump_cont(rmff_cont_t *cont, char *buffer) {
   cont->size=_X_BE_32(&cont->size);
   cont->object_version=_X_BE_16(&cont->object_version);
   cont->object_id=_X_BE_32(&cont->object_id);
+
+  return RMFF_CONTHEADER_SIZE + cont->title_len + cont->author_len +
+         cont->copyright_len + cont->comment_len;
 }
 
-static void rmff_dump_dataheader(rmff_data_t *data, char *buffer) {
+static int rmff_dump_dataheader(rmff_data_t *data, uint8_t *buffer, int bufsize) {
+
+  if (!data) return 0;
+
+  if (bufsize < RMFF_DATAHEADER_SIZE)
+    return -1;
 
-  if (!data) return;
   data->object_id=_X_BE_32(&data->object_id);
   data->size=_X_BE_32(&data->size);
   data->object_version=_X_BE_16(&data->object_version);
@@ -195,37 +228,49 @@ static void rmff_dump_dataheader(rmff_data_t *data, char *buffer) {
   memcpy(buffer, data, 8);
   memcpy(&buffer[8], &data->object_version, 2);
   memcpy(&buffer[10], &data->num_packets, 8);
-  
+
   data->num_packets=_X_BE_32(&data->num_packets);
   data->next_data_header=_X_BE_32(&data->next_data_header);
   data->size=_X_BE_32(&data->size);
   data->object_version=_X_BE_16(&data->object_version);
   data->object_id=_X_BE_32(&data->object_id);
+
+  return RMFF_DATAHEADER_SIZE;
 }
 
-int rmff_dump_header(rmff_header_t *h, char *buffer, int max) {
+int rmff_dump_header(rmff_header_t *h, void *buf_gen, int max) {
+  uint8_t *buffer = buf_gen;
 
-  int written=0;
+  int written=0, size;
   rmff_mdpr_t **stream=h->streams;
 
-  rmff_dump_fileheader(h->fileheader, &buffer[written]);
-  written+=h->fileheader->size;
-  rmff_dump_prop(h->prop, &buffer[written]);
-  written+=h->prop->size;
-  rmff_dump_cont(h->cont, &buffer[written]);
-  written+=h->cont->size;
+  if ((size=rmff_dump_fileheader(h->fileheader, &buffer[written], max)) < 0)
+    return -1;
+  written+=size;
+  max -= size;
+  if ((size=rmff_dump_prop(h->prop, &buffer[written], max)) < 0)
+    return -1;
+  written+=size;
+  max -= size;
+  if ((size=rmff_dump_cont(h->cont, &buffer[written], max)) < 0)
+    return -1;
+  written+=size;
+  max -= size;
   if (stream)
   {
     while(*stream)
     {
-      rmff_dump_mdpr(*stream, &buffer[written]);
-      written+=(*stream)->size;
+      if ((size=rmff_dump_mdpr(*stream, &buffer[written], max)) < 0)
+        return -1;
+      written+=size;
+      max -= size;
       stream++;
     }
   }
-    
-  rmff_dump_dataheader(h->data, &buffer[written]);
-  written+=18;
+
+  if ((size=rmff_dump_dataheader(h->data, &buffer[written], max)) < 0)
+    return -1;
+  written+=size;
 
   return written;
 }
@@ -289,12 +334,14 @@ static rmff_prop_t *rmff_scan_prop(const char *data) {
   return prop;
 }
 
-static rmff_mdpr_t *rmff_scan_mdpr(const char *data) {
-
-  rmff_mdpr_t *mdpr = malloc(sizeof(rmff_mdpr_t));
+static rmff_mdpr_t *rmff_scan_mdpr(const char *data)
+{
+  rmff_mdpr_t *mdpr = calloc(sizeof(rmff_mdpr_t), 1);
 
   mdpr->object_id=_X_BE_32(data);
   mdpr->size=_X_BE_32(&data[4]);
+  if (mdpr->size < 46)
+    goto fail;
   mdpr->object_version=_X_BE_16(&data[8]);
   if (mdpr->object_version != 0)
   {
@@ -308,23 +355,42 @@ static rmff_mdpr_t *rmff_scan_mdpr(const char *data) {
   mdpr->start_time=_X_BE_32(&data[28]);
   mdpr->preroll=_X_BE_32(&data[32]);
   mdpr->duration=_X_BE_32(&data[36]);
-  
+
   mdpr->stream_name_size=data[40];
-  mdpr->stream_name = malloc(sizeof(char)*(mdpr->stream_name_size+1));
+  if (mdpr->size < 46 + mdpr->stream_name_size)
+    goto fail;
+  mdpr->stream_name = malloc(mdpr->stream_name_size+1);
+  if (!mdpr->stream_name)
+    goto fail;
   memcpy(mdpr->stream_name, &data[41], mdpr->stream_name_size);
   mdpr->stream_name[mdpr->stream_name_size]=0;
-  
+
   mdpr->mime_type_size=data[41+mdpr->stream_name_size];
-  mdpr->mime_type = malloc(sizeof(char)*(mdpr->mime_type_size+1));
+  if (mdpr->size < 46 + mdpr->stream_name_size + mdpr->mime_type_size)
+    goto fail;
+  mdpr->mime_type = malloc(mdpr->mime_type_size+1);
+  if (!mdpr->mime_type)
+    goto fail;
   memcpy(mdpr->mime_type, &data[42+mdpr->stream_name_size], mdpr->mime_type_size);
   mdpr->mime_type[mdpr->mime_type_size]=0;
-  
+
   mdpr->type_specific_len=_X_BE_32(&data[42+mdpr->stream_name_size+mdpr->mime_type_size]);
-  mdpr->type_specific_data = malloc(sizeof(char)*(mdpr->type_specific_len));
-  memcpy(mdpr->type_specific_data, 
+  if (mdpr->size < 46 + mdpr->stream_name_size + mdpr->mime_type_size + mdpr->type_specific_data)
+    goto fail;
+  mdpr->type_specific_data = malloc(mdpr->type_specific_len);
+  if (!mdpr->type_specific_data)
+    goto fail;
+  memcpy(mdpr->type_specific_data,
       &data[46+mdpr->stream_name_size+mdpr->mime_type_size], mdpr->type_specific_len);
-  
+
   return mdpr;
+
+fail:
+  free (mdpr->stream_name);
+  free (mdpr->mime_type);
+  free (mdpr->type_specific_data);
+  free (mdpr);
+  return NULL;
 }
 
 static rmff_cont_t *rmff_scan_cont(const char *data) {
@@ -340,22 +406,22 @@ static rmff_cont_t *rmff_scan_cont(const char *data) {
     lprintf("warning: unknown object version in CONT: 0x%04x\n", cont->object_version);
   }
   cont->title_len=_X_BE_16(&data[10]);
-  cont->title = malloc(sizeof(char)*(cont->title_len+1));
+  cont->title = malloc(cont->title_len+1);
   memcpy(cont->title, &data[12], cont->title_len);
   cont->title[cont->title_len]=0;
   pos=cont->title_len+12;
   cont->author_len=_X_BE_16(&data[pos]);
-  cont->author = malloc(sizeof(char)*(cont->author_len+1));
+  cont->author = malloc(cont->author_len+1);
   memcpy(cont->author, &data[pos+2], cont->author_len);
   cont->author[cont->author_len]=0;
   pos=pos+2+cont->author_len;
   cont->copyright_len=_X_BE_16(&data[pos]);
-  cont->copyright = malloc(sizeof(char)*(cont->copyright_len+1));
+  cont->copyright = malloc(cont->copyright_len+1);
   memcpy(cont->copyright, &data[pos+2], cont->copyright_len);
   cont->copyright[cont->copyright_len]=0;
   pos=pos+2+cont->copyright_len;
   cont->comment_len=_X_BE_16(&data[pos]);
-  cont->comment = malloc(sizeof(char)*(cont->comment_len+1));
+  cont->comment = malloc(cont->comment_len+1);
   memcpy(cont->comment, &data[pos+2], cont->comment_len);
   cont->comment[cont->comment_len]=0;
 
@@ -378,7 +444,7 @@ static rmff_data_t *rmff_scan_dataheader(const char *data) {
 
   return dh;
 }
- 
+
 rmff_header_t *rmff_scan_header(const char *data) {
 
 	rmff_header_t *header = malloc(sizeof(rmff_header_t));
@@ -402,21 +468,18 @@ rmff_header_t *rmff_scan_header(const char *data) {
   }
   header->fileheader=rmff_scan_fileheader(ptr);
   ptr += header->fileheader->size;
-	
-  header->streams = malloc(sizeof(rmff_mdpr_t*)*(header->fileheader->num_headers));
-  for (i=0; i<header->fileheader->num_headers; i++) {
-    header->streams[i]=NULL;
-  }
-  
+
+  header->streams = calloc(header->fileheader->num_headers, sizeof(rmff_mdpr_t*));
+
   for (i=1; i<header->fileheader->num_headers; i++) {
     chunk_type = _X_BE_32(ptr);
-  
+
     if (ptr[0] == 0)
     {
       lprintf("rmff: warning: only %d of %d header found.\n", i, header->fileheader->num_headers);
       break;
     }
-    
+
     chunk_size=1;
     switch (chunk_type) {
     case PROP_TAG:
@@ -425,8 +488,11 @@ rmff_header_t *rmff_scan_header(const char *data) {
       break;
     case MDPR_TAG:
       mdpr=rmff_scan_mdpr(ptr);
-      chunk_size=mdpr->size;
-      header->streams[mdpr->stream_number]=mdpr;
+      if (mdpr) /* FIXME: what to do if NULL? */
+      {
+        chunk_size=mdpr->size;
+        header->streams[mdpr->stream_number]=mdpr;
+      }
       break;
     case CONT_TAG:
       header->cont=rmff_scan_cont(ptr);
@@ -544,7 +610,7 @@ rmff_prop_t *rmff_new_prop (
   prop->data_offset=data_offset;
   prop->num_streams=num_streams;
   prop->flags=flags;
-   
+
   return prop;
 }
 
@@ -563,7 +629,7 @@ rmff_mdpr_t *rmff_new_mdpr(
       const char *type_specific_data ) {
 
   rmff_mdpr_t *mdpr = malloc(sizeof(rmff_mdpr_t));
-  
+
   mdpr->object_id=MDPR_TAG;
   mdpr->object_version=0;
 
@@ -586,10 +652,10 @@ rmff_mdpr_t *rmff_new_mdpr(
     mdpr->mime_type_size=strlen(mime_type);
   }
   mdpr->type_specific_len=type_specific_len;
-  mdpr->type_specific_data = malloc(sizeof(char)*type_specific_len);
+  mdpr->type_specific_data = malloc(type_specific_len);
   memcpy(mdpr->type_specific_data,type_specific_data,type_specific_len);
   mdpr->mlti_data=NULL;
-  
+
   mdpr->size=mdpr->stream_name_size+mdpr->mime_type_size+mdpr->type_specific_len+46;
 
   return mdpr;
@@ -606,7 +672,7 @@ rmff_cont_t *rmff_new_cont(const char *title, const char *author, const char *co
   cont->author=NULL;
   cont->copyright=NULL;
   cont->comment=NULL;
-  
+
   cont->title_len=0;
   cont->author_len=0;
   cont->copyright_len=0;
@@ -645,11 +711,11 @@ rmff_data_t *rmff_new_dataheader(uint32_t num_packets, uint32_t next_data_header
 
   return data;
 }
-  
+
 void rmff_print_header(rmff_header_t *h) {
 
   rmff_mdpr_t **stream;
-  
+
   if(!h) {
     printf("rmff_print_header: NULL given\n");
     return;
@@ -710,7 +776,7 @@ void rmff_print_header(rmff_header_t *h) {
     printf("size      : %i\n", h->data->size);
     printf("packets   : %i\n", h->data->num_packets);
     printf("next DATA : 0x%08x\n", h->data->next_data_header);
-  } 
+  }
 }
 
 void rmff_fix_header(rmff_header_t *h) {
@@ -738,7 +804,7 @@ void rmff_fix_header(rmff_header_t *h) {
       streams++;
     }
   }
-  
+
   if (h->prop) {
     if (h->prop->size != 50)
     {
@@ -775,7 +841,7 @@ void rmff_fix_header(rmff_header_t *h) {
   }
   num_headers++;
 
-  
+
   if (!h->fileheader) {
     lprintf("rmff_fix_header: no fileheader, creating one");
 
@@ -790,31 +856,31 @@ void rmff_fix_header(rmff_header_t *h) {
   num_headers++;
 
   if(h->fileheader->num_headers != num_headers) {
-    lprintf("rmff_fix_header: setting num_headers from %i to %i\n", h->fileheader->num_headers, num_headers); 
+    lprintf("rmff_fix_header: setting num_headers from %i to %i\n", h->fileheader->num_headers, num_headers);
 
     h->fileheader->num_headers=num_headers;
   }
 
   if(h->prop) {
     if (h->prop->data_offset != header_size) {
-      lprintf("rmff_fix_header: setting prop.data_offset from %i to %i\n", h->prop->data_offset, header_size); 
+      lprintf("rmff_fix_header: setting prop.data_offset from %i to %i\n", h->prop->data_offset, header_size);
 
       h->prop->data_offset=header_size;
     }
     if (h->prop->num_packets == 0) {
       int p=(int)(h->prop->avg_bit_rate/8.0*(h->prop->duration/1000.0)/h->prop->avg_packet_size);
 
-      lprintf("rmff_fix_header: assuming prop.num_packets=%i\n", p); 
+      lprintf("rmff_fix_header: assuming prop.num_packets=%i\n", p);
 
       h->prop->num_packets=p;
     }
     if (h->data->num_packets == 0) {
-      lprintf("rmff_fix_header: assuming data.num_packets=%i\n", h->prop->num_packets); 
+      lprintf("rmff_fix_header: assuming data.num_packets=%i\n", h->prop->num_packets);
 
       h->data->num_packets=h->prop->num_packets;
     }
-    
-    lprintf("rmff_fix_header: assuming data.size=%i\n", h->prop->num_packets*h->prop->avg_packet_size); 
+
+    lprintf("rmff_fix_header: assuming data.size=%i\n", h->prop->num_packets*h->prop->avg_packet_size);
 
     h->data->size=h->prop->num_packets*h->prop->avg_packet_size;
   }
@@ -826,7 +892,7 @@ int rmff_get_header_size(rmff_header_t *h) {
   if (!h->prop) return -1;
 
   return h->prop->data_offset+18;
-  
+
 }
 
 void rmff_free_header(rmff_header_t *h) {