Commit 692e323d authored by James Almer's avatar James Almer

avcodec/av1_parse: return size of the parsed OBU in parse_obu_header()

Signed-off-by: 's avatarJames Almer <jamrial@gmail.com>
parent 1e126560
...@@ -29,11 +29,12 @@ int ff_av1_extract_obu(AV1OBU *obu, const uint8_t *buf, int length, void *logctx ...@@ -29,11 +29,12 @@ int ff_av1_extract_obu(AV1OBU *obu, const uint8_t *buf, int length, void *logctx
{ {
int64_t obu_size; int64_t obu_size;
int start_pos, type, temporal_id, spatial_id; int start_pos, type, temporal_id, spatial_id;
int len, ret;
int ret = parse_obu_header(buf, length, &obu_size, &start_pos, len = parse_obu_header(buf, length, &obu_size, &start_pos,
&type, &temporal_id, &spatial_id); &type, &temporal_id, &spatial_id);
if (ret < 0) if (len < 0)
return ret; return len;
if (obu_size > INT_MAX / 8 || obu_size < 0) if (obu_size > INT_MAX / 8 || obu_size < 0)
return AVERROR(ERANGE); return AVERROR(ERANGE);
...@@ -42,12 +43,10 @@ int ff_av1_extract_obu(AV1OBU *obu, const uint8_t *buf, int length, void *logctx ...@@ -42,12 +43,10 @@ int ff_av1_extract_obu(AV1OBU *obu, const uint8_t *buf, int length, void *logctx
obu->temporal_id = temporal_id; obu->temporal_id = temporal_id;
obu->spatial_id = spatial_id; obu->spatial_id = spatial_id;
length = obu_size + start_pos;
obu->data = buf + start_pos; obu->data = buf + start_pos;
obu->size = obu_size; obu->size = obu_size;
obu->raw_data = buf; obu->raw_data = buf;
obu->raw_size = length; obu->raw_size = len;
ret = init_get_bits(&obu->gb, obu->data, obu->size * 8); ret = init_get_bits(&obu->gb, obu->data, obu->size * 8);
if (ret < 0) if (ret < 0)
...@@ -57,7 +56,7 @@ int ff_av1_extract_obu(AV1OBU *obu, const uint8_t *buf, int length, void *logctx ...@@ -57,7 +56,7 @@ int ff_av1_extract_obu(AV1OBU *obu, const uint8_t *buf, int length, void *logctx
"obu_type: %d, temporal_id: %d, spatial_id: %d, payload size: %d\n", "obu_type: %d, temporal_id: %d, spatial_id: %d, payload size: %d\n",
obu->type, obu->temporal_id, obu->spatial_id, obu->size); obu->type, obu->temporal_id, obu->spatial_id, obu->size);
return length; return len;
} }
int ff_av1_packet_split(AV1Packet *pkt, const uint8_t *buf, int length, void *logctx) int ff_av1_packet_split(AV1Packet *pkt, const uint8_t *buf, int length, void *logctx)
......
...@@ -95,6 +95,7 @@ static inline int parse_obu_header(const uint8_t *buf, int buf_size, ...@@ -95,6 +95,7 @@ static inline int parse_obu_header(const uint8_t *buf, int buf_size,
{ {
GetBitContext gb; GetBitContext gb;
int ret, extension_flag, has_size_flag; int ret, extension_flag, has_size_flag;
int64_t size;
ret = init_get_bits8(&gb, buf, FFMIN(buf_size, 2 + 8)); // OBU header fields + max leb128 length ret = init_get_bits8(&gb, buf, FFMIN(buf_size, 2 + 8)); // OBU header fields + max leb128 length
if (ret < 0) if (ret < 0)
...@@ -124,7 +125,12 @@ static inline int parse_obu_header(const uint8_t *buf, int buf_size, ...@@ -124,7 +125,12 @@ static inline int parse_obu_header(const uint8_t *buf, int buf_size,
*start_pos = get_bits_count(&gb) / 8; *start_pos = get_bits_count(&gb) / 8;
return 0; size = *obu_size + *start_pos;
if (size > INT_MAX)
return AVERROR(ERANGE);
return size;
} }
#endif /* AVCODEC_AV1_PARSE_H */ #endif /* AVCODEC_AV1_PARSE_H */
...@@ -33,14 +33,10 @@ int ff_av1_filter_obus(AVIOContext *pb, const uint8_t *buf, int size) ...@@ -33,14 +33,10 @@ int ff_av1_filter_obus(AVIOContext *pb, const uint8_t *buf, int size)
size = 0; size = 0;
while (buf < end) { while (buf < end) {
int ret = parse_obu_header(buf, end - buf, &obu_size, &start_pos, int len = parse_obu_header(buf, end - buf, &obu_size, &start_pos,
&type, &temporal_id, &spatial_id); &type, &temporal_id, &spatial_id);
if (ret < 0) if (len < 0)
return ret; return len;
obu_size += start_pos;
if (obu_size > INT_MAX)
return AVERROR_INVALIDDATA;
switch (type) { switch (type) {
case AV1_OBU_TEMPORAL_DELIMITER: case AV1_OBU_TEMPORAL_DELIMITER:
...@@ -48,11 +44,11 @@ int ff_av1_filter_obus(AVIOContext *pb, const uint8_t *buf, int size) ...@@ -48,11 +44,11 @@ int ff_av1_filter_obus(AVIOContext *pb, const uint8_t *buf, int size)
case AV1_OBU_PADDING: case AV1_OBU_PADDING:
break; break;
default: default:
avio_write(pb, buf, obu_size); avio_write(pb, buf, len);
size += obu_size; size += len;
break; break;
} }
buf += obu_size; buf += len;
} }
return size; return size;
...@@ -86,25 +82,21 @@ int ff_isom_write_av1c(AVIOContext *pb, const uint8_t *buf, int size) ...@@ -86,25 +82,21 @@ int ff_isom_write_av1c(AVIOContext *pb, const uint8_t *buf, int size)
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
while (size > 0) { while (size > 0) {
int ret = parse_obu_header(buf, size, &obu_size, &start_pos, int len = parse_obu_header(buf, size, &obu_size, &start_pos,
&type, &temporal_id, &spatial_id); &type, &temporal_id, &spatial_id);
if (ret < 0) if (len < 0)
return ret; return len;
obu_size += start_pos;
if (obu_size > INT_MAX)
return AVERROR_INVALIDDATA;
switch (type) { switch (type) {
case AV1_OBU_SEQUENCE_HEADER: case AV1_OBU_SEQUENCE_HEADER:
case AV1_OBU_METADATA: case AV1_OBU_METADATA:
avio_write(pb, buf, obu_size); avio_write(pb, buf, len);
break; break;
default: default:
break; break;
} }
size -= obu_size; size -= len;
buf += obu_size; buf += len;
} }
return 0; return 0;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment