Commit daa29058 authored by Michael Niedermayer's avatar Michael Niedermayer

mxfdec: simplify code by using av_calloc()

Reviewed a long time ago by: Tomas Härdin <tomas.hardin@codemill.se>
Signed-off-by: 's avatarMichael Niedermayer <michaelni@gmx.at>
parent 83d6ad36
...@@ -410,12 +410,14 @@ static int mxf_read_primer_pack(void *arg, AVIOContext *pb, int tag, int size, U ...@@ -410,12 +410,14 @@ static int mxf_read_primer_pack(void *arg, AVIOContext *pb, int tag, int size, U
item_len); item_len);
return AVERROR_PATCHWELCOME; return AVERROR_PATCHWELCOME;
} }
if (item_num > UINT_MAX / item_len) if (item_num > 65536) {
av_log(mxf->fc, AV_LOG_ERROR, "item_num %d is too large\n", item_num);
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
mxf->local_tags_count = item_num; }
mxf->local_tags = av_malloc(item_num*item_len); mxf->local_tags = av_calloc(item_num, item_len);
if (!mxf->local_tags) if (!mxf->local_tags)
return AVERROR(ENOMEM); return AVERROR(ENOMEM);
mxf->local_tags_count = item_num;
avio_read(pb, mxf->local_tags, item_num*item_len); avio_read(pb, mxf->local_tags, item_num*item_len);
return 0; return 0;
} }
...@@ -585,9 +587,7 @@ static int mxf_read_content_storage(void *arg, AVIOContext *pb, int tag, int siz ...@@ -585,9 +587,7 @@ static int mxf_read_content_storage(void *arg, AVIOContext *pb, int tag, int siz
switch (tag) { switch (tag) {
case 0x1901: case 0x1901:
mxf->packages_count = avio_rb32(pb); mxf->packages_count = avio_rb32(pb);
if (mxf->packages_count >= UINT_MAX / sizeof(UID)) mxf->packages_refs = av_calloc(mxf->packages_count, sizeof(UID));
return AVERROR_INVALIDDATA;
mxf->packages_refs = av_malloc(mxf->packages_count * sizeof(UID));
if (!mxf->packages_refs) if (!mxf->packages_refs)
return AVERROR(ENOMEM); return AVERROR(ENOMEM);
avio_skip(pb, 4); /* useless size of objects, always 16 according to specs */ avio_skip(pb, 4); /* useless size of objects, always 16 according to specs */
...@@ -625,9 +625,7 @@ static int mxf_read_material_package(void *arg, AVIOContext *pb, int tag, int si ...@@ -625,9 +625,7 @@ static int mxf_read_material_package(void *arg, AVIOContext *pb, int tag, int si
switch(tag) { switch(tag) {
case 0x4403: case 0x4403:
package->tracks_count = avio_rb32(pb); package->tracks_count = avio_rb32(pb);
if (package->tracks_count >= UINT_MAX / sizeof(UID)) package->tracks_refs = av_calloc(package->tracks_count, sizeof(UID));
return AVERROR_INVALIDDATA;
package->tracks_refs = av_malloc(package->tracks_count * sizeof(UID));
if (!package->tracks_refs) if (!package->tracks_refs)
return AVERROR(ENOMEM); return AVERROR(ENOMEM);
avio_skip(pb, 4); /* useless size of objects, always 16 according to specs */ avio_skip(pb, 4); /* useless size of objects, always 16 according to specs */
...@@ -687,9 +685,7 @@ static int mxf_read_sequence(void *arg, AVIOContext *pb, int tag, int size, UID ...@@ -687,9 +685,7 @@ static int mxf_read_sequence(void *arg, AVIOContext *pb, int tag, int size, UID
break; break;
case 0x1001: case 0x1001:
sequence->structural_components_count = avio_rb32(pb); sequence->structural_components_count = avio_rb32(pb);
if (sequence->structural_components_count >= UINT_MAX / sizeof(UID)) sequence->structural_components_refs = av_calloc(sequence->structural_components_count, sizeof(UID));
return AVERROR_INVALIDDATA;
sequence->structural_components_refs = av_malloc(sequence->structural_components_count * sizeof(UID));
if (!sequence->structural_components_refs) if (!sequence->structural_components_refs)
return AVERROR(ENOMEM); return AVERROR(ENOMEM);
avio_skip(pb, 4); /* useless size of objects, always 16 according to specs */ avio_skip(pb, 4); /* useless size of objects, always 16 according to specs */
...@@ -705,9 +701,7 @@ static int mxf_read_source_package(void *arg, AVIOContext *pb, int tag, int size ...@@ -705,9 +701,7 @@ static int mxf_read_source_package(void *arg, AVIOContext *pb, int tag, int size
switch(tag) { switch(tag) {
case 0x4403: case 0x4403:
package->tracks_count = avio_rb32(pb); package->tracks_count = avio_rb32(pb);
if (package->tracks_count >= UINT_MAX / sizeof(UID)) package->tracks_refs = av_calloc(package->tracks_count, sizeof(UID));
return AVERROR_INVALIDDATA;
package->tracks_refs = av_malloc(package->tracks_count * sizeof(UID));
if (!package->tracks_refs) if (!package->tracks_refs)
return AVERROR(ENOMEM); return AVERROR(ENOMEM);
avio_skip(pb, 4); /* useless size of objects, always 16 according to specs */ avio_skip(pb, 4); /* useless size of objects, always 16 according to specs */
...@@ -811,9 +805,7 @@ static int mxf_read_generic_descriptor(void *arg, AVIOContext *pb, int tag, int ...@@ -811,9 +805,7 @@ static int mxf_read_generic_descriptor(void *arg, AVIOContext *pb, int tag, int
switch(tag) { switch(tag) {
case 0x3F01: case 0x3F01:
descriptor->sub_descriptors_count = avio_rb32(pb); descriptor->sub_descriptors_count = avio_rb32(pb);
if (descriptor->sub_descriptors_count >= UINT_MAX / sizeof(UID)) descriptor->sub_descriptors_refs = av_calloc(descriptor->sub_descriptors_count, sizeof(UID));
return AVERROR_INVALIDDATA;
descriptor->sub_descriptors_refs = av_malloc(descriptor->sub_descriptors_count * sizeof(UID));
if (!descriptor->sub_descriptors_refs) if (!descriptor->sub_descriptors_refs)
return AVERROR(ENOMEM); return AVERROR(ENOMEM);
avio_skip(pb, 4); /* useless size of objects, always 16 according to specs */ avio_skip(pb, 4); /* useless size of objects, always 16 according to specs */
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment