| 67 | } |
| 68 | |
| 69 | int ff_parse_a53_cc(AVBufferRef **pbuf, const uint8_t *data, int size) |
| 70 | { |
| 71 | AVBufferRef *buf = *pbuf; |
| 72 | GetBitContext gb; |
| 73 | size_t new_size, old_size = buf ? buf->size : 0; |
| 74 | int ret, cc_count; |
| 75 | |
| 76 | if (size < 3) |
| 77 | return AVERROR_INVALIDDATA; |
| 78 | |
| 79 | ret = init_get_bits8(&gb, data, size); |
| 80 | if (ret < 0) |
| 81 | return ret; |
| 82 | |
| 83 | if (get_bits(&gb, 8) != 0x3) // user_data_type_code |
| 84 | return 0; |
| 85 | |
| 86 | skip_bits(&gb, 1); // reserved |
| 87 | if (!get_bits(&gb, 1)) // process_cc_data_flag |
| 88 | return 0; |
| 89 | |
| 90 | skip_bits(&gb, 1); // zero bit |
| 91 | cc_count = get_bits(&gb, 5); |
| 92 | if (!cc_count) |
| 93 | return 0; |
| 94 | |
| 95 | skip_bits(&gb, 8); // reserved |
| 96 | |
| 97 | /* 3 bytes per CC plus one byte marker_bits at the end */ |
| 98 | if (cc_count * 3 >= (get_bits_left(&gb) >> 3)) |
| 99 | return AVERROR_INVALIDDATA; |
| 100 | |
| 101 | new_size = (old_size + cc_count * 3); |
| 102 | |
| 103 | if (new_size > INT_MAX) |
| 104 | return AVERROR_INVALIDDATA; |
| 105 | |
| 106 | /* Allow merging of the cc data from two fields. */ |
| 107 | ret = av_buffer_realloc(pbuf, new_size); |
| 108 | if (ret < 0) |
| 109 | return ret; |
| 110 | |
| 111 | buf = *pbuf; |
| 112 | /* Use of av_buffer_realloc assumes buffer is writeable */ |
| 113 | for (int i = 0; i < cc_count; i++) { |
| 114 | buf->data[old_size++] = get_bits(&gb, 8); |
| 115 | buf->data[old_size++] = get_bits(&gb, 8); |
| 116 | buf->data[old_size++] = get_bits(&gb, 8); |
| 117 | } |
| 118 | |
| 119 | return cc_count; |
| 120 | } |
no test coverage detected