Commit 3dee6c09 authored by Marton Balint's avatar Marton Balint

avformat/mxfdec: fix and enhance RIP KLV length checks

KLV length is BER encoded (variable size), but the code assumed the encoding to
always use 4 bytes.

Fixes parsing Random Index Pack in samples/MXF/issue2160/PW0805A0V01.4C5B5636.EFA330.mxf.
Signed-off-by: 's avatarMarton Balint <cus@passwd.hu>
parent fc15e830
...@@ -3138,9 +3138,12 @@ static void mxf_read_random_index_pack(AVFormatContext *s) ...@@ -3138,9 +3138,12 @@ static void mxf_read_random_index_pack(AVFormatContext *s)
goto end; goto end;
avio_seek(s->pb, file_size - length, SEEK_SET); avio_seek(s->pb, file_size - length, SEEK_SET);
if (klv_read_packet(&klv, s->pb) < 0 || if (klv_read_packet(&klv, s->pb) < 0 ||
!IS_KLV_KEY(klv.key, mxf_random_index_pack_key) || !IS_KLV_KEY(klv.key, mxf_random_index_pack_key))
klv.length != length - 20)
goto end; goto end;
if (klv.next_klv != file_size || klv.length <= 4 || (klv.length - 4) % 12) {
av_log(s, AV_LOG_WARNING, "Invalid RIP KLV length\n");
goto end;
}
avio_skip(s->pb, klv.length - 12); avio_skip(s->pb, klv.length - 12);
mxf->footer_partition = avio_rb64(s->pb); mxf->footer_partition = avio_rb64(s->pb);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment