Skip to content

Commit e1b6da0

Browse files
author
eagleychen
committed
添加nalu大小判断,防止异常数据
1 parent 139799f commit e1b6da0

File tree

1 file changed

+6
-4
lines changed

1 file changed

+6
-4
lines changed

ijkmedia/ijkplayer/ff_ffplay.c

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5487,10 +5487,6 @@ uint32_t convert_hex_to_decimal(uint8_t *hex_data) {
54875487
int parse_sei(AVPacket *pkt, uint8_t *uuid, uint8_t **content, int *size)
54885488
{
54895489
// printf("\n SEI===LENT===%d \n",pkt->size);
5490-
MPTRACE("\n SEI===LENT===%d \n",pkt->size);
5491-
if (pkt->size < 6) {
5492-
return -1;
5493-
}
54945490

54955491
uint8_t *p = pkt->data;
54965492
uint8_t *p_end = p + pkt->size;
@@ -5510,6 +5506,9 @@ int parse_sei(AVPacket *pkt, uint8_t *uuid, uint8_t **content, int *size)
55105506

55115507
uint32_t nalu_len = convert_hex_to_decimal(p);
55125508
// printf("\n SEI===nalu_len===%d \n",nalu_len);
5509+
if (nalu_len > INT32_MAX) {
5510+
return -1;
5511+
}
55135512

55145513
while (p < p_end) {
55155514
if (p[4] == 0x06 && p[5] == 0x05 && p + 2 < p_end) { // found SEI NAL; payload_type = 5 表示 user_data_unregistered;
@@ -5568,6 +5567,9 @@ int parse_sei_hevc(AVPacket *pkt, uint8_t *uuid, uint8_t **content, int *size)
55685567

55695568
uint32_t nalu_len = convert_hex_to_decimal(p);
55705569
// printf("\n SEI===nalu_len===%d \n",nalu_len);
5570+
if (nalu_len > INT32_MAX) {
5571+
return -1;
5572+
}
55715573

55725574
while (p < p_end) {
55735575
if (p[4] == 0x4E && p[5] == 0x01 && p[6] == 0x05 && p + 3 < p_end) { // found SEI NAL; payload_type = 5 表示 user_data_unregistered;

0 commit comments

Comments
 (0)