webm_read_frame: avoid NULL dereference

[libvpx] / ivfdec.c

diff --git a/ivfdec.c b/ivfdec.c
index c7f4a894717f7b9576826e8819e43e1f37313abd..f64e594ab0e6952a83363518fe0175672196d452 100644 (file)
--- a/ivfdec.c
+++ b/ivfdec.c
@@ -8,17 +8,22 @@
  *  be found in the AUTHORS file in the root of the source tree.
  */
 
-#include "./ivfdec.h"
-
 #include <stdio.h>
 #include <stdlib.h>
+#include <string.h>
+
+#include "vpx_ports/mem_ops.h"
+
+#include "./ivfdec.h"
+
+static const char *IVF_SIGNATURE = "DKIF";
 
 static void fix_framerate(int *num, int *den) {
   // Some versions of vpxenc used 1/(2*fps) for the timebase, so
   // we can guess the framerate using only the timebase in this
   // case. Other files would require reading ahead to guess the
   // timebase, like we do for webm.
-  if (*num < 1000) {
+  if (*den > 0 && *den < 1000000000 && *num > 0 && *num < 1000) {
     // Correct for the factor of 2 applied to the timebase in the encoder.
     if (*num & 1)
       *den *= 2;
@@ -37,12 +42,12 @@ int file_is_ivf(struct VpxInputContext *input_ctx) {
   int is_ivf = 0;
 
   if (fread(raw_hdr, 1, 32, input_ctx->file) == 32) {
-    if (raw_hdr[0] == 'D' && raw_hdr[1] == 'K' &&
-        raw_hdr[2] == 'I' && raw_hdr[3] == 'F') {
+    if (memcmp(IVF_SIGNATURE, raw_hdr, 4) == 0) {
       is_ivf = 1;
 
       if (mem_get_le16(raw_hdr + 4) != 0) {
-        fprintf(stderr, "Error: Unrecognized IVF version! This file may not"
+        fprintf(stderr,
+                "Error: Unrecognized IVF version! This file may not"
                 " decode properly.");
       }
 
@@ -65,14 +70,13 @@ int file_is_ivf(struct VpxInputContext *input_ctx) {
   return is_ivf;
 }
 
-int ivf_read_frame(FILE *infile, uint8_t **buffer,
-                   size_t *bytes_read, size_t *buffer_size) {
-  char raw_header[IVF_FRAME_HDR_SZ] = {0};
+int ivf_read_frame(FILE *infile, uint8_t **buffer, size_t *bytes_read,
+                   size_t *buffer_size) {
+  char raw_header[IVF_FRAME_HDR_SZ] = { 0 };
   size_t frame_size = 0;
 
   if (fread(raw_header, IVF_FRAME_HDR_SZ, 1, infile) != 1) {
-    if (!feof(infile))
-      warn("Failed to read frame size\n");
+    if (!feof(infile)) warn("Failed to read frame size\n");
   } else {
     frame_size = mem_get_le32(raw_header);