From e97efecec82ca8458a9bbd75a91ebf556abde362 Mon Sep 17 00:00:00 2001
From: "Ronald S. Bultje" <rsbultje@gmail.com>
Date: Wed, 7 Mar 2012 13:48:41 -0800
Subject: dv: check buffer size before reading profile.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
---
 libavcodec/dvdata.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

(limited to 'libavcodec/dvdata.c')

diff --git a/libavcodec/dvdata.c b/libavcodec/dvdata.c
index e9929d0997..ac6e993d2f 100644
--- a/libavcodec/dvdata.c
+++ b/libavcodec/dvdata.c
@@ -286,11 +286,13 @@ static const DVprofile dv_profiles[] = {
 const DVprofile* avpriv_dv_frame_profile(const DVprofile *sys,
                                   const uint8_t* frame, unsigned buf_size)
 {
-   int i;
+   int i, dsf, stype;
 
-   int dsf = (frame[3] & 0x80) >> 7;
+    if (buf_size < 80*5 + 48 + 4)
+        return NULL;
 
-   int stype = frame[80*5 + 48 + 3] & 0x1f;
+   dsf = (frame[3] & 0x80) >> 7;
+   stype = frame[80*5 + 48 + 3] & 0x1f;
 
    /* 576i50 25Mbps 4:1:1 is a special case */
    if (dsf == 1 && stype == 0 && frame[4] & 0x07 /* the APT field */) {
-- 
cgit v1.2.1


From 3416d0805ec224ac814158162c065ceacfd7c2fa Mon Sep 17 00:00:00 2001
From: "Ronald S. Bultje" <rsbultje@gmail.com>
Date: Wed, 7 Mar 2012 13:49:41 -0800
Subject: dv: cosmetics.

---
 libavcodec/dvdata.c | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

(limited to 'libavcodec/dvdata.c')

diff --git a/libavcodec/dvdata.c b/libavcodec/dvdata.c
index ac6e993d2f..1d32304edf 100644
--- a/libavcodec/dvdata.c
+++ b/libavcodec/dvdata.c
@@ -286,28 +286,28 @@ static const DVprofile dv_profiles[] = {
 const DVprofile* avpriv_dv_frame_profile(const DVprofile *sys,
                                   const uint8_t* frame, unsigned buf_size)
 {
-   int i, dsf, stype;
+    int i, dsf, stype;
 
-    if (buf_size < 80*5 + 48 + 4)
+    if (buf_size < 80 * 5 + 48 + 4)
         return NULL;
 
-   dsf = (frame[3] & 0x80) >> 7;
-   stype = frame[80*5 + 48 + 3] & 0x1f;
+    dsf = (frame[3] & 0x80) >> 7;
+    stype = frame[80 * 5 + 48 + 3] & 0x1f;
 
-   /* 576i50 25Mbps 4:1:1 is a special case */
-   if (dsf == 1 && stype == 0 && frame[4] & 0x07 /* the APT field */) {
-       return &dv_profiles[2];
-   }
+    /* 576i50 25Mbps 4:1:1 is a special case */
+    if (dsf == 1 && stype == 0 && frame[4] & 0x07 /* the APT field */) {
+        return &dv_profiles[2];
+    }
 
-   for (i=0; i<FF_ARRAY_ELEMS(dv_profiles); i++)
-       if (dsf == dv_profiles[i].dsf && stype == dv_profiles[i].video_stype)
-           return &dv_profiles[i];
+    for (i = 0; i < FF_ARRAY_ELEMS(dv_profiles); i++)
+        if (dsf == dv_profiles[i].dsf && stype == dv_profiles[i].video_stype)
+            return &dv_profiles[i];
 
-   /* check if old sys matches and assumes corrupted input */
-   if (sys && buf_size == sys->frame_size)
-       return sys;
+    /* check if old sys matches and assumes corrupted input */
+    if (sys && buf_size == sys->frame_size)
+        return sys;
 
-   return NULL;
+    return NULL;
 }
 
 const DVprofile* avpriv_dv_codec_profile(AVCodecContext* codec)
-- 
cgit v1.2.1