| 182 | } |
| 183 | |
| 184 | static int decode_main_header(NUTContext *nut){ |
| 185 | AVFormatContext *s= nut->avf; |
| 186 | ByteIOContext *bc = s->pb; |
| 187 | uint64_t tmp, end; |
| 188 | unsigned int stream_count; |
| 189 | int i, j, tmp_stream, tmp_mul, tmp_pts, tmp_size, count, tmp_res, tmp_head_idx; |
| 190 | int64_t tmp_match; |
| 191 | |
| 192 | end= get_packetheader(nut, bc, 1, MAIN_STARTCODE); |
| 193 | end += url_ftell(bc); |
| 194 | |
| 195 | GET_V(tmp , tmp >=2 && tmp <= 3) |
| 196 | GET_V(stream_count , tmp > 0 && tmp <=MAX_STREAMS) |
| 197 | |
| 198 | nut->max_distance = ff_get_v(bc); |
| 199 | if(nut->max_distance > 65536){ |
| 200 | av_log(s, AV_LOG_DEBUG, "max_distance %d\n", nut->max_distance); |
| 201 | nut->max_distance= 65536; |
| 202 | } |
| 203 | |
| 204 | GET_V(nut->time_base_count, tmp>0 && tmp<INT_MAX / sizeof(AVRational)) |
| 205 | nut->time_base= av_malloc(nut->time_base_count * sizeof(AVRational)); |
| 206 | |
| 207 | for(i=0; i<nut->time_base_count; i++){ |
| 208 | GET_V(nut->time_base[i].num, tmp>0 && tmp<(1ULL<<31)) |
| 209 | GET_V(nut->time_base[i].den, tmp>0 && tmp<(1ULL<<31)) |
| 210 | if(av_gcd(nut->time_base[i].num, nut->time_base[i].den) != 1){ |
| 211 | av_log(s, AV_LOG_ERROR, "time base invalid\n"); |
| 212 | return -1; |
| 213 | } |
| 214 | } |
| 215 | tmp_pts=0; |
| 216 | tmp_mul=1; |
| 217 | tmp_stream=0; |
| 218 | tmp_match= 1-(1LL<<62); |
| 219 | tmp_head_idx= 0; |
| 220 | for(i=0; i<256;){ |
| 221 | int tmp_flags = ff_get_v(bc); |
| 222 | int tmp_fields= ff_get_v(bc); |
| 223 | if(tmp_fields>0) tmp_pts = get_s(bc); |
| 224 | if(tmp_fields>1) tmp_mul = ff_get_v(bc); |
| 225 | if(tmp_fields>2) tmp_stream= ff_get_v(bc); |
| 226 | if(tmp_fields>3) tmp_size = ff_get_v(bc); |
| 227 | else tmp_size = 0; |
| 228 | if(tmp_fields>4) tmp_res = ff_get_v(bc); |
| 229 | else tmp_res = 0; |
| 230 | if(tmp_fields>5) count = ff_get_v(bc); |
| 231 | else count = tmp_mul - tmp_size; |
| 232 | if(tmp_fields>6) tmp_match = get_s(bc); |
| 233 | if(tmp_fields>7) tmp_head_idx= ff_get_v(bc); |
| 234 | |
| 235 | while(tmp_fields-- > 8) |
| 236 | ff_get_v(bc); |
| 237 | |
| 238 | if(count == 0 || i+count > 256){ |
| 239 | av_log(s, AV_LOG_ERROR, "illegal count %d at %d\n", count, i); |
| 240 | return -1; |
| 241 | } |
no test coverage detected