Commit 35005a4a authored by Andreas Rheinhardt's avatar Andreas Rheinhardt Committed by Michael Niedermayer

avformat/flac_picture: Simplify checks

During parsing a flac picture metadata block, the mimetype is read as
follows: Its 32b size field is read and checked for being in the range
1..63; afterwards, the actual mimetype-string is read into a buffer of
size 64, where the length to read is the minimum of the length field and
the size of the destination buffer -1. Then an assert guards that length
is indeed < the size of the destination buffer before the string in the
buffer is zero-terminated.

The FFMIN as well as the assert are actually redundant, as it has
been checked that the string (even after terminating) fits into the
buffer. In order to make this clear, reword the check "len >= 64" to
"len >= sizeof(mimetype)" and drop the FFMIN as well as the assert.
Signed-off-by: 's avatarAndreas Rheinhardt <andreas.rheinhardt@gmail.com>
Signed-off-by: 's avatarMichael Niedermayer <michael@niedermayer.cc>
parent 9cc88ed4
...@@ -19,7 +19,6 @@ ...@@ -19,7 +19,6 @@
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
*/ */
#include "libavutil/avassert.h"
#include "libavutil/intreadwrite.h" #include "libavutil/intreadwrite.h"
#include "libavcodec/png.h" #include "libavcodec/png.h"
#include "avformat.h" #include "avformat.h"
...@@ -54,15 +53,14 @@ int ff_flac_parse_picture(AVFormatContext *s, uint8_t *buf, int buf_size) ...@@ -54,15 +53,14 @@ int ff_flac_parse_picture(AVFormatContext *s, uint8_t *buf, int buf_size)
/* picture mimetype */ /* picture mimetype */
len = avio_rb32(pb); len = avio_rb32(pb);
if (len <= 0 || len >= 64 || if (len <= 0 || len >= sizeof(mimetype) ||
avio_read(pb, mimetype, FFMIN(len, sizeof(mimetype) - 1)) != len) { avio_read(pb, mimetype, len) != len) {
av_log(s, AV_LOG_ERROR, "Could not read mimetype from an attached " av_log(s, AV_LOG_ERROR, "Could not read mimetype from an attached "
"picture.\n"); "picture.\n");
if (s->error_recognition & AV_EF_EXPLODE) if (s->error_recognition & AV_EF_EXPLODE)
ret = AVERROR_INVALIDDATA; ret = AVERROR_INVALIDDATA;
goto fail; goto fail;
} }
av_assert0(len < sizeof(mimetype));
mimetype[len] = 0; mimetype[len] = 0;
while (mime->id != AV_CODEC_ID_NONE) { while (mime->id != AV_CODEC_ID_NONE) {
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment