Merge commit '5d0450461ff729be5f531d333d29754155e406c5'
authorMichael Niedermayer <michaelni@gmx.at>
Thu, 10 Jan 2013 11:52:02 +0000 (12:52 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Thu, 10 Jan 2013 11:52:02 +0000 (12:52 +0100)
* commit '5d0450461ff729be5f531d333d29754155e406c5':
  idcin: better error handling
  idcin: check for integer overflow when calling av_get_packet()

Conflicts:
libavformat/idcin.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>
1  2 
libavformat/idcin.c

@@@ -250,8 -260,8 +260,8 @@@ static int idcin_read_packet(AVFormatCo
      unsigned char palette_buffer[768];
      uint32_t palette[256];
  
 -    if (s->pb->eof_reached)
 +    if (url_feof(s->pb))
-         return AVERROR(EIO);
+         return s->pb->error ? s->pb->error : AVERROR_EOF;
  
      if (idcin->next_chunk_is_video) {
          command = avio_rl32(pb);
              }
          }
  
+         if (s->pb->eof_reached) {
+             av_log(s, AV_LOG_ERROR, "incomplete packet\n");
+             return s->pb->error ? s->pb->error : AVERROR_EOF;
+         }
          chunk_size = avio_rl32(pb);
+         if (chunk_size < 4 || chunk_size > INT_MAX - 4) {
+             av_log(s, AV_LOG_ERROR, "invalid chunk size: %u\n", chunk_size);
+             return AVERROR_INVALIDDATA;
+         }
          /* skip the number of decoded bytes (always equal to width * height) */
          avio_skip(pb, 4);
 +        if (chunk_size < 4)
 +            return AVERROR_INVALIDDATA;
          chunk_size -= 4;
          ret= av_get_packet(pb, pkt, chunk_size);
          if (ret < 0)