Merge commit '4d0ee4962be7e07cdc038a78008ef2e4e47e5f81'
authorMichael Niedermayer <michaelni@gmx.at>
Sun, 10 May 2015 20:19:01 +0000 (22:19 +0200)
committerMichael Niedermayer <michaelni@gmx.at>
Sun, 10 May 2015 20:20:37 +0000 (22:20 +0200)
* commit '4d0ee4962be7e07cdc038a78008ef2e4e47e5f81':
  avi: Validate sample_size

Conflicts:
libavformat/avidec.c

See: ca234639ac49a0dc073ac1f10977979acdb94f97
See: c7369f3a4bd21ea64571c1b0c4fcbf39f8daf68c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
1  2 
libavformat/avidec.c

@@@ -691,18 -568,28 +691,32 @@@ static int avi_read_header(AVFormatCont
                  codec_type = AVMEDIA_TYPE_DATA;
                  break;
              default:
 -                av_log(s, AV_LOG_ERROR, "unknown stream type %X\n", tag1);
 -                goto fail;
 +                av_log(s, AV_LOG_INFO, "unknown stream type %X\n", tag1);
              }
-             if (ast->sample_size < 0)
-                 av_log(s, AV_LOG_WARNING, "sample size %d is invalid\n", ast->sample_size);
-             ast->sample_size = FFMAX(ast->sample_size, 0);
+             if (ast->sample_size < 0) {
+                 if (s->error_recognition & AV_EF_EXPLODE) {
+                     av_log(s, AV_LOG_ERROR,
+                            "Invalid sample_size %d at stream %d\n",
+                            ast->sample_size,
+                            stream_index);
+                     goto fail;
+                 }
+                 av_log(s, AV_LOG_WARNING,
+                        "Invalid sample_size %d at stream %d "
+                        "setting it to 0\n",
+                        ast->sample_size,
+                        stream_index);
+                 ast->sample_size = 0;
+             }
 -            if (ast->sample_size == 0)
 +            if (ast->sample_size == 0) {
                  st->duration = st->nb_frames;
 +                if (st->duration > 0 && avi->io_fsize > 0 && avi->riff_end > avi->io_fsize) {
 +                    av_log(s, AV_LOG_DEBUG, "File is truncated adjusting duration\n");
 +                    st->duration = av_rescale(st->duration, avi->io_fsize, avi->riff_end);
 +                }
 +            }
              ast->frame_offset = ast->cum_len;
              avio_skip(pb, size - 12 * 4);
              break;