Add checks to ff_split_xiph_headers to ensure that returned header_len and
[ffmpeg.git] / libavcodec / xiph.c
1 /*
2  * Copyright (C) 2007  FFmpeg Project
3  *
4  * This file is part of FFmpeg.
5  *
6  * FFmpeg is free software; you can redistribute it and/or
7  * modify it under the terms of the GNU Lesser General Public
8  * License as published by the Free Software Foundation; either
9  * version 2.1 of the License, or (at your option) any later version.
10  *
11  * FFmpeg is distributed in the hope that it will be useful,
12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
14  * Lesser General Public License for more details.
15  *
16  * You should have received a copy of the GNU Lesser General Public
17  * License along with FFmpeg; if not, write to the Free Software
18  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
19  */
20
21 #include "xiph.h"
22
23 int ff_split_xiph_headers(uint8_t *extradata, int extradata_size,
24                           int first_header_size, uint8_t *header_start[3],
25                           int header_len[3])
26 {
27     int i, j;
28
29     if (extradata_size >= 6 && AV_RB16(extradata) == first_header_size) {
30         int overall_len = 6;
31         for (i=0; i<3; i++) {
32             header_len[i] = AV_RB16(extradata);
33             extradata += 2;
34             header_start[i] = extradata;
35             extradata += header_len[i];
36             if (overall_len > extradata_size - header_len[i])
37                 return -1;
38             overall_len += header_len[i];
39         }
40     } else if (extradata_size >= 3 && extradata_size < INT_MAX - 0x1ff && extradata[0] == 2) {
41         int overall_len = 3;
42         for (i=0,j=1; i<2; i++,j++) {
43             header_len[i] = 0;
44             for (; overall_len < extradata_size && extradata[j]==0xff; j++) {
45                 header_len[i] += 0xff;
46                 overall_len   += 0xff + 1;
47             }
48             overall_len   += extradata[j];
49             if (overall_len > extradata_size)
50                 return -1;
51
52             header_len[i] += extradata[j];
53         }
54         header_len[2] = extradata_size - header_len[0] - header_len[1] - j;
55         extradata += j;
56         header_start[0] = extradata;
57         header_start[1] = header_start[0] + header_len[0];
58         header_start[2] = header_start[1] + header_len[1];
59     } else {
60         return -1;
61     }
62     return 0;
63 }