Skip to content

V
vlc-1.1
Commit a89f96d8 authored by Pavlov Konstantin's avatar Pavlov Konstantin
Browse files
Options

Port some fixes from CVE-2008-0225 fix for xine-lib plus some code style... 

Port some fixes from CVE-2008-0225 fix for xine-lib plus some code style fixes. Someone should really review it as it may be not fully fixed.
parent ce68b58c
Hide whitespace changes
Inline Side-by-side
Showing with 207 additions and 157 deletions
modules/access/rtsp/real_rmff.c
View file @ a89f96d8
...@@ -35,157 +35,184 @@ ...@@ -35,157 +35,184 @@
* writes header data to a buffer * writes header data to a buffer
*/ */
static void rmff_dump_fileheader(rmff_fileheader_t *fileheader, char *buffer) { static int rmff_dump_fileheader(rmff_fileheader_t *fileheader, uint8_t *buffer, int bufsize) {
if (!fileheader) return 0;
if (!fileheader) return; if (bufsize < RMFF_FILEHEADER_SIZE)
fileheader->object_id=BE_32(&fileheader->object_id); return -1;
fileheader->size=BE_32(&fileheader->size);
fileheader->object_version=BE_16(&fileheader->object_version); fileheader->object_id=BE_32(&fileheader->object_id);
fileheader->file_version=BE_32(&fileheader->file_version); fileheader->size=BE_32(&fileheader->size);
fileheader->num_headers=BE_32(&fileheader->num_headers); fileheader->object_version=BE_16(&fileheader->object_version);
fileheader->file_version=BE_32(&fileheader->file_version);
memcpy(buffer, fileheader, 8); fileheader->num_headers=BE_32(&fileheader->num_headers);
memcpy(&buffer[8], &fileheader->object_version, 2);
memcpy(&buffer[10], &fileheader->file_version, 8); memcpy(buffer, fileheader, 8);
memcpy(&buffer[8], &fileheader->object_version, 2);
fileheader->size=BE_32(&fileheader->size); memcpy(&buffer[10], &fileheader->file_version, 8);
fileheader->object_version=BE_16(&fileheader->object_version);
fileheader->file_version=BE_32(&fileheader->file_version); fileheader->size=BE_32(&fileheader->size);
fileheader->num_headers=BE_32(&fileheader->num_headers); fileheader->object_version=BE_16(&fileheader->object_version);
fileheader->object_id=BE_32(&fileheader->object_id); fileheader->file_version=BE_32(&fileheader->file_version);
fileheader->num_headers=BE_32(&fileheader->num_headers);
fileheader->object_id=BE_32(&fileheader->object_id);
return RMFF_FILEHEADER_SIZE;
} }
static void rmff_dump_prop(rmff_prop_t *prop, char *buffer) { static int rmff_dump_prop(rmff_prop_t *prop, uint8_t *buffer, int bufsize) {
if (!prop) return; if (!prop) return 0;
prop->object_id=BE_32(&prop->object_id);
prop->size=BE_32(&prop->size); if (bufsize < RMFF_PROPHEADER_SIZE)
prop->object_version=BE_16(&prop->object_version); return -1;
prop->max_bit_rate=BE_32(&prop->max_bit_rate);
prop->avg_bit_rate=BE_32(&prop->avg_bit_rate); prop->object_id=BE_32(&prop->object_id);
prop->max_packet_size=BE_32(&prop->max_packet_size); prop->size=BE_32(&prop->size);
prop->avg_packet_size=BE_32(&prop->avg_packet_size); prop->object_version=BE_16(&prop->object_version);
prop->num_packets=BE_32(&prop->num_packets); prop->max_bit_rate=BE_32(&prop->max_bit_rate);
prop->duration=BE_32(&prop->duration); prop->avg_bit_rate=BE_32(&prop->avg_bit_rate);
prop->preroll=BE_32(&prop->preroll); prop->max_packet_size=BE_32(&prop->max_packet_size);
prop->index_offset=BE_32(&prop->index_offset); prop->avg_packet_size=BE_32(&prop->avg_packet_size);
prop->data_offset=BE_32(&prop->data_offset); prop->num_packets=BE_32(&prop->num_packets);
prop->num_streams=BE_16(&prop->num_streams); prop->duration=BE_32(&prop->duration);
prop->flags=BE_16(&prop->flags); prop->preroll=BE_32(&prop->preroll);
prop->index_offset=BE_32(&prop->index_offset);
memcpy(buffer, prop, 8); prop->data_offset=BE_32(&prop->data_offset);
memcpy(&buffer[8], &prop->object_version, 2); prop->num_streams=BE_16(&prop->num_streams);
memcpy(&buffer[10], &prop->max_bit_rate, 36); prop->flags=BE_16(&prop->flags);
memcpy(&buffer[46], &prop->num_streams, 2);
memcpy(&buffer[48], &prop->flags, 2); memcpy(buffer, prop, 8);
memcpy(&buffer[8], &prop->object_version, 2);
prop->size=BE_32(&prop->size); memcpy(&buffer[10], &prop->max_bit_rate, 36);
prop->object_version=BE_16(&prop->object_version); memcpy(&buffer[46], &prop->num_streams, 2);
prop->max_bit_rate=BE_32(&prop->max_bit_rate); memcpy(&buffer[48], &prop->flags, 2);
prop->avg_bit_rate=BE_32(&prop->avg_bit_rate);
prop->max_packet_size=BE_32(&prop->max_packet_size); prop->size=BE_32(&prop->size);
prop->avg_packet_size=BE_32(&prop->avg_packet_size); prop->object_version=BE_16(&prop->object_version);
prop->num_packets=BE_32(&prop->num_packets); prop->max_bit_rate=BE_32(&prop->max_bit_rate);
prop->duration=BE_32(&prop->duration); prop->avg_bit_rate=BE_32(&prop->avg_bit_rate);
prop->preroll=BE_32(&prop->preroll); prop->max_packet_size=BE_32(&prop->max_packet_size);
prop->index_offset=BE_32(&prop->index_offset); prop->avg_packet_size=BE_32(&prop->avg_packet_size);
prop->data_offset=BE_32(&prop->data_offset); prop->num_packets=BE_32(&prop->num_packets);
prop->num_streams=BE_16(&prop->num_streams); prop->duration=BE_32(&prop->duration);
prop->flags=BE_16(&prop->flags); prop->preroll=BE_32(&prop->preroll);
prop->object_id=BE_32(&prop->object_id); prop->index_offset=BE_32(&prop->index_offset);
prop->data_offset=BE_32(&prop->data_offset);
prop->num_streams=BE_16(&prop->num_streams);
prop->flags=BE_16(&prop->flags);
prop->object_id=BE_32(&prop->object_id);
return RMFF_PROPHEADER_SIZE;
} }
static void rmff_dump_mdpr(rmff_mdpr_t *mdpr, char *buffer) { static int rmff_dump_mdpr(rmff_mdpr_t *mdpr, uint8_t *buffer, int bufsize) {
int s1, s2, s3; int s1, s2, s3;
if (!mdpr) return; if (!mdpr) return 0;
mdpr->object_id=BE_32(&mdpr->object_id); if (bufsize < RMFF_MDPRHEADER_SIZE + mdpr->type_specific_len +
mdpr->size=BE_32(&mdpr->size); mdpr->stream_name_size + mdpr->mime_type_size)
mdpr->object_version=BE_16(&mdpr->object_version); return -1;
mdpr->stream_number=BE_16(&mdpr->stream_number);
mdpr->max_bit_rate=BE_32(&mdpr->max_bit_rate); mdpr->object_id=BE_32(&mdpr->object_id);
mdpr->avg_bit_rate=BE_32(&mdpr->avg_bit_rate); mdpr->size=BE_32(&mdpr->size);
mdpr->max_packet_size=BE_32(&mdpr->max_packet_size); mdpr->object_version=BE_16(&mdpr->object_version);
mdpr->avg_packet_size=BE_32(&mdpr->avg_packet_size); mdpr->stream_number=BE_16(&mdpr->stream_number);
mdpr->start_time=BE_32(&mdpr->start_time); mdpr->max_bit_rate=BE_32(&mdpr->max_bit_rate);
mdpr->preroll=BE_32(&mdpr->preroll); mdpr->avg_bit_rate=BE_32(&mdpr->avg_bit_rate);
mdpr->duration=BE_32(&mdpr->duration); mdpr->max_packet_size=BE_32(&mdpr->max_packet_size);
mdpr->avg_packet_size=BE_32(&mdpr->avg_packet_size);
memcpy(buffer, mdpr, 8); mdpr->start_time=BE_32(&mdpr->start_time);
memcpy(&buffer[8], &mdpr->object_version, 2); mdpr->preroll=BE_32(&mdpr->preroll);
memcpy(&buffer[10], &mdpr->stream_number, 2); mdpr->duration=BE_32(&mdpr->duration);
memcpy(&buffer[12], &mdpr->max_bit_rate, 28);
memcpy(&buffer[40], &mdpr->stream_name_size, 1); memcpy(buffer, mdpr, 8);
s1=mdpr->stream_name_size; memcpy(&buffer[8], &mdpr->object_version, 2);
memcpy(&buffer[41], mdpr->stream_name, s1); memcpy(&buffer[10], &mdpr->stream_number, 2);
memcpy(&buffer[12], &mdpr->max_bit_rate, 28);
memcpy(&buffer[41+s1], &mdpr->mime_type_size, 1); memcpy(&buffer[40], &mdpr->stream_name_size, 1);
s2=mdpr->mime_type_size; s1=mdpr->stream_name_size;
memcpy(&buffer[42+s1], mdpr->mime_type, s2); memcpy(&buffer[41], mdpr->stream_name, s1);
mdpr->type_specific_len=BE_32(&mdpr->type_specific_len); memcpy(&buffer[41+s1], &mdpr->mime_type_size, 1);
memcpy(&buffer[42+s1+s2], &mdpr->type_specific_len, 4); s2=mdpr->mime_type_size;
mdpr->type_specific_len=BE_32(&mdpr->type_specific_len); memcpy(&buffer[42+s1], mdpr->mime_type, s2);
s3=mdpr->type_specific_len;
memcpy(&buffer[46+s1+s2], mdpr->type_specific_data, s3); mdpr->type_specific_len=BE_32(&mdpr->type_specific_len);
memcpy(&buffer[42+s1+s2], &mdpr->type_specific_len, 4);
mdpr->size=BE_32(&mdpr->size); mdpr->type_specific_len=BE_32(&mdpr->type_specific_len);
mdpr->stream_number=BE_16(&mdpr->stream_number); s3=mdpr->type_specific_len;
mdpr->max_bit_rate=BE_32(&mdpr->max_bit_rate); memcpy(&buffer[46+s1+s2], mdpr->type_specific_data, s3);
mdpr->avg_bit_rate=BE_32(&mdpr->avg_bit_rate);
mdpr->max_packet_size=BE_32(&mdpr->max_packet_size); mdpr->size=BE_32(&mdpr->size);
mdpr->avg_packet_size=BE_32(&mdpr->avg_packet_size); mdpr->stream_number=BE_16(&mdpr->stream_number);
mdpr->start_time=BE_32(&mdpr->start_time); mdpr->max_bit_rate=BE_32(&mdpr->max_bit_rate);
mdpr->preroll=BE_32(&mdpr->preroll); mdpr->avg_bit_rate=BE_32(&mdpr->avg_bit_rate);
mdpr->duration=BE_32(&mdpr->duration); mdpr->max_packet_size=BE_32(&mdpr->max_packet_size);
mdpr->object_id=BE_32(&mdpr->object_id); mdpr->avg_packet_size=BE_32(&mdpr->avg_packet_size);
mdpr->start_time=BE_32(&mdpr->start_time);
mdpr->preroll=BE_32(&mdpr->preroll);
mdpr->duration=BE_32(&mdpr->duration);
mdpr->object_id=BE_32(&mdpr->object_id);
return RMFF_MDPRHEADER_SIZE + s1 + s2 + s3;
} }
static void rmff_dump_cont(rmff_cont_t *cont, char *buffer) { static int rmff_dump_cont(rmff_cont_t *cont, uint8_t *buffer, int bufsize) {
int p;
if (!cont) return 0;
if (bufsize < RMFF_CONTHEADER_SIZE + cont->title_len + cont->author_len + \
cont->copyright_len + cont->comment_len)
return -1;
int p; cont->object_id=BE_32(&cont->object_id);
cont->size=BE_32(&cont->size);
cont->object_version=BE_16(&cont->object_version);
if (!cont) return; memcpy(buffer, cont, 8);
cont->object_id=BE_32(&cont->object_id); memcpy(&buffer[8], &cont->object_version, 2);
cont->size=BE_32(&cont->size);
cont->object_version=BE_16(&cont->object_version);
memcpy(buffer, cont, 8); cont->title_len=BE_16(&cont->title_len);
memcpy(&buffer[8], &cont->object_version, 2); memcpy(&buffer[10], &cont->title_len, 2);
cont->title_len=BE_16(&cont->title_len);
memcpy(&buffer[12], cont->title, cont->title_len);
p=12+cont->title_len;
cont->title_len=BE_16(&cont->title_len); cont->author_len=BE_16(&cont->author_len);
memcpy(&buffer[10], &cont->title_len, 2); memcpy(&buffer[p], &cont->author_len, 2);
cont->title_len=BE_16(&cont->title_len); cont->author_len=BE_16(&cont->author_len);
memcpy(&buffer[12], cont->title, cont->title_len); memcpy(&buffer[p+2], cont->author, cont->author_len);
p=12+cont->title_len; p+=2+cont->author_len;
cont->author_len=BE_16(&cont->author_len); cont->copyright_len=BE_16(&cont->copyright_len);
memcpy(&buffer[p], &cont->author_len, 2); memcpy(&buffer[p], &cont->copyright_len, 2);
cont->author_len=BE_16(&cont->author_len); cont->copyright_len=BE_16(&cont->copyright_len);
memcpy(&buffer[p+2], cont->author, cont->author_len); memcpy(&buffer[p+2], cont->copyright, cont->copyright_len);
p+=2+cont->author_len; p+=2+cont->copyright_len;
cont->copyright_len=BE_16(&cont->copyright_len); cont->comment_len=BE_16(&cont->comment_len);
memcpy(&buffer[p], &cont->copyright_len, 2); memcpy(&buffer[p], &cont->comment_len, 2);
cont->copyright_len=BE_16(&cont->copyright_len); cont->comment_len=BE_16(&cont->comment_len);
memcpy(&buffer[p+2], cont->copyright, cont->copyright_len); memcpy(&buffer[p+2], cont->comment, cont->comment_len);
p+=2+cont->copyright_len;
cont->comment_len=BE_16(&cont->comment_len); cont->size=BE_32(&cont->size);
memcpy(&buffer[p], &cont->comment_len, 2); cont->object_version=BE_16(&cont->object_version);
cont->comment_len=BE_16(&cont->comment_len); cont->object_id=BE_32(&cont->object_id);
memcpy(&buffer[p+2], cont->comment, cont->comment_len);
cont->size=BE_32(&cont->size); return RMFF_CONTHEADER_SIZE + cont->title_len + cont->author_len + \
cont->object_version=BE_16(&cont->object_version); cont->copyright_len + cont->comment_len;
cont->object_id=BE_32(&cont->object_id);
} }
static void rmff_dump_dataheader(rmff_data_t *data, char *buffer) { static int rmff_dump_dataheader(rmff_data_t *data, uint8_t *buffer, int bufsize) {
if (!data) return 0;
if (bufsize < RMFF_DATAHEADER_SIZE)
return -1;
if (!data) return;
data->object_id=BE_32(&data->object_id); data->object_id=BE_32(&data->object_id);
data->size=BE_32(&data->size); data->size=BE_32(&data->size);
...@@ -202,33 +229,50 @@ static void rmff_dump_dataheader(rmff_data_t *data, char *buffer) { ...@@ -202,33 +229,50 @@ static void rmff_dump_dataheader(rmff_data_t *data, char *buffer) {
data->size=BE_32(&data->size); data->size=BE_32(&data->size);
data->object_version=BE_16(&data->object_version); data->object_version=BE_16(&data->object_version);
data->object_id=BE_32(&data->object_id); data->object_id=BE_32(&data->object_id);
}
int rmff_dump_header(rmff_header_t *h, char *buffer, int max) { return RMFF_DATAHEADER_SIZE;
}
int written=0;
rmff_mdpr_t **stream=h->streams;
rmff_dump_fileheader(h->fileheader, &buffer[written]); int rmff_dump_header(rmff_header_t *h, void *buf_gen, int max) {
written+=h->fileheader->size; uint8_t *buffer = buf_gen;
rmff_dump_prop(h->prop, &buffer[written]);
written+=h->prop->size; int written=0, size;
rmff_dump_cont(h->cont, &buffer[written]); rmff_mdpr_t **stream=h->streams;
written+=h->cont->size;
if (stream) if ((size=rmff_dump_fileheader(h->fileheader, &buffer[written], max)) < 0)
{ return -1;
while(*stream)
{ written += size;
rmff_dump_mdpr(*stream, &buffer[written]); max -= size;
written+=(*stream)->size;
stream++; if ((size=rmff_dump_prop(h->prop, &buffer[written], max)) < 0)
return -1;
written += size;
max -= size;
if ((size=rmff_dump_cont(h->cont, &buffer[written], max)) < 0)
return -1;
written += size;
max -= size;
if (stream) {
while(*stream) {
if ((size=rmff_dump_mdpr(*stream, &buffer[written], max)) < 0)
return -1;
written += size;
max -= size;
stream++;
}
} }
}
rmff_dump_dataheader(h->data, &buffer[written]); if ((size=rmff_dump_dataheader(h->data, &buffer[written], max)) < 0)
written+=18; return -1;
written+=size;
return written; return written;
} }
void rmff_dump_pheader(rmff_pheader_t *h, char *data) { void rmff_dump_pheader(rmff_pheader_t *h, char *data) {
......
modules/access/rtsp/real_rmff.h
View file @ a89f96d8
...@@ -29,6 +29,12 @@ ...@@ -29,6 +29,12 @@
#define RMFF_HEADER_SIZE 0x12 #define RMFF_HEADER_SIZE 0x12
#define RMFF_FILEHEADER_SIZE 18
#define RMFF_PROPHEADER_SIZE 50
#define RMFF_MDPRHEADER_SIZE 46
#define RMFF_CONTHEADER_SIZE 18
#define RMFF_DATAHEADER_SIZE 18
#define FOURCC_TAG( ch0, ch1, ch2, ch3 ) \ #define FOURCC_TAG( ch0, ch1, ch2, ch3 ) \
(((long)(unsigned char)(ch3) ) | \ (((long)(unsigned char)(ch3) ) | \
( (long)(unsigned char)(ch2) << 8 ) | \ ( (long)(unsigned char)(ch2) << 8 ) | \
...@@ -234,7 +240,7 @@ int rmff_get_header_size(rmff_header_t *h); ...@@ -234,7 +240,7 @@ int rmff_get_header_size(rmff_header_t *h);
/* /*
* dumps the header <h> to <buffer>. <max> is the size of <buffer> * dumps the header <h> to <buffer>. <max> is the size of <buffer>
*/ */
int rmff_dump_header(rmff_header_t *h, char *buffer, int max); int rmff_dump_header(rmff_header_t *h, void *buffer, int max);
/* /*
* dumps a packet header * dumps a packet header
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment