From patchwork Sat May 7 09:36:44 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Aman Karmani X-Patchwork-Id: 35628 Delivered-To: ffmpegpatchwork2@gmail.com Received: by 2002:a05:6a20:a885:b0:7f:4be2:bd17 with SMTP id ca5csp2088569pzb; Sat, 7 May 2022 02:37:49 -0700 (PDT) X-Google-Smtp-Source: ABdhPJxHy69eITtD5NpKWAUqQ5W0ycb4Uu8zy5Enc841gIfn/N0I/aIRjhYw44pz8Dc6FGivVB6t X-Received: by 2002:a17:907:d29:b0:6f4:87d4:ecad with SMTP id gn41-20020a1709070d2900b006f487d4ecadmr6459706ejc.166.1651916269081; Sat, 07 May 2022 02:37:49 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1651916269; cv=none; d=google.com; s=arc-20160816; b=j+zJ6ETPWgBJ4c/S1YSrwtawQ1+6UmIjJuIc/loPgYobC6e93tPf9Z9F2NCdUf69n3 R1ZwCk+T5d6Ft5olDLEbLtkXzX+z4WMk9D3U1KQupI/MqQpkQyhVVqeToD6K+vbElGBh xdOo8M3WlOrAbIkXLgoxIo2jVo+LLOzPHcFvo//Ve7wccJQInK7DsR2Xys+nwE5+uLk/ LtWPYE8I+827O87lS16oeLSVL3Ywdc9vasZoTbnzex2Z0S+ZWeV2t5pcCPfaAV/8mf9g NVvwD6H3/R19lTSwPI1CzLgRsvyhkzF/ghdkxNngps4oP4COcYfuNk17cw5gY33XosTk e4SA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:content-transfer-encoding:cc:reply-to :list-subscribe:list-help:list-post:list-archive:list-unsubscribe :list-id:precedence:subject:to:mime-version:fcc:date:references :in-reply-to:message-id:from:dkim-signature:delivered-to; bh=6vtGa0eaH/zmj7jdtv/sPrCXnhSWd5fcz+tT4VXc+cc=; b=lKsDG0DM9SVfWc42ZRFLxUUW5YXf7W+PXUFI+oQ4wd67qQkVOWS8x4knHkaZSst0Ci wOJfmgSZzPj+7f9JSvQgC5Si7C0uZwB3DqnOsRxyQphTloRQrI1AMMXevQXqPq9Lp5ff bmlCj3z4fNRyDHB41S0QmrxgD30+g+ixJ3pWtjDEp//jwqai3sUoh5MIGnkGvKCIg0rB ibd4/Ly6zqP3gJZuJ4RDbGa0pqKz9G2T3roRGNCo1NB0bv2kHa4O+isy1IWM5DjPs8Aj GfpUb3vgr3B4YoYr9Naoq620aii23TkboyLLnrjEba6tPM9P5jmY+uhrJK9gzfFkBkrK B1WA== ARC-Authentication-Results: i=1; mx.google.com; dkim=neutral (body hash did not verify) header.i=@gmail.com header.s=20210112 header.b=AQmxnBEK; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org; dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org. [79.124.17.100]) by mx.google.com with ESMTP id u14-20020a17090617ce00b006f3b3927a12si6823292eje.833.2022.05.07.02.37.48; Sat, 07 May 2022 02:37:49 -0700 (PDT) Received-SPF: pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) client-ip=79.124.17.100; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@gmail.com header.s=20210112 header.b=AQmxnBEK; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org; dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 1645368B3C1; Sat, 7 May 2022 12:37:02 +0300 (EEST) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from mail-pj1-f50.google.com (mail-pj1-f50.google.com [209.85.216.50]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 54E7C68B39A for ; Sat, 7 May 2022 12:36:58 +0300 (EEST) Received: by mail-pj1-f50.google.com with SMTP id p6so9075839pjm.1 for ; Sat, 07 May 2022 02:36:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=from:message-id:in-reply-to:references:date:subject:fcc :content-transfer-encoding:mime-version:to:cc; bh=pmwsYjeiamXINSvfOZdbnerYiu8XL2oR+AbxZDy3ah8=; b=AQmxnBEKmT3+pfuVeEI3aVat0lAMPuJayNIbBnHkeUDj0RLpFtwOgtPYW+QgiMjNZ+ l30LrtBQMLeQka7BFWS3m/X+P6NMI15tt25aydb1zbT8EY5uFE+NXgw+xowOsp1ZnfrR 35/Xcskm+w80gJ4SF0CrXep4GSG4Sx4fn/xa6b7gAc8/iH4gQ+OBQ+/dw+dvbJfivMvH L//Px2PSXQ78KGS+d/bD4EU15KACA2eKHvL/H0A5GoVsLrcHMoPw4iJlgQX8sxwJVZV2 hKBj7SHENKghsjRBwI26y0lQ9XrB6KLDXc6pCwMMntwTKa6XYXn2B8uWdTkepb6J8SSh iEeQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:message-id:in-reply-to:references:date :subject:fcc:content-transfer-encoding:mime-version:to:cc; bh=pmwsYjeiamXINSvfOZdbnerYiu8XL2oR+AbxZDy3ah8=; b=MOaByR6nEnpNqXEcUIWoiTNGuwblX3ffGaJM6KGMqSu0uRcw7NC8ZRRNnqgBK1bpJc zsNAMfwgeF5t0U1GVh0STBq+s+DKKYdat5DFyP7gVcmKhf2XZyhCKzIefnCACGk5uvKx wehlKlMJtVbaa+8cx1H+GI8kvgMpP/I/YOI8AZSC8hxrpwbQK6uSQUQ/ef4jwErL/7y0 8/UF7Ds29QUb8nE3J+LunVSkmY6uuIREhNfdXIvY+RAn0DYeXIK+w/ZFBW+UmoVIvsb6 k1ORmXb0LhvCyCsc0ZgZhog76PjRnoLaBhkLbQ8+3f+6cphqPgmtAOIvgFhbfNwvY+Ff JHFg== X-Gm-Message-State: AOAM530WC45+u3Ft3pkQJ8s1jMZkwXSP26twBf7WQs83sX7lZgOGxlCy XBc11j3YFElZY6+KHKbvkoI3AN6xWCYs1w== X-Received: by 2002:a17:90a:e2cb:b0:1da:35d6:3a08 with SMTP id fr11-20020a17090ae2cb00b001da35d63a08mr17075190pjb.223.1651916217722; Sat, 07 May 2022 02:36:57 -0700 (PDT) Received: from [127.0.0.1] (master.gitmailbox.com. [34.83.118.50]) by smtp.gmail.com with ESMTPSA id a4-20020a170903100400b0015e8d4eb1fdsm3203667plb.71.2022.05.07.02.36.57 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Sat, 07 May 2022 02:36:57 -0700 (PDT) From: softworkz X-Google-Original-From: softworkz Message-Id: In-Reply-To: References: Date: Sat, 07 May 2022 09:36:44 +0000 Fcc: Sent MIME-Version: 1.0 To: ffmpeg-devel@ffmpeg.org Subject: [FFmpeg-devel] [PATCH v2 11/11] libavformat/asfdec: fix variable types and add checks for unsupported values X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Cc: softworkz Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" X-TUID: xRx4joyK1uV/ From: softworkz Signed-off-by: softworkz --- libavformat/asfdec_f.c | 168 ++++++++++++++++++++++++++--------------- 1 file changed, 108 insertions(+), 60 deletions(-) diff --git a/libavformat/asfdec_f.c b/libavformat/asfdec_f.c index b8140a6d57..c7141f6da1 100644 --- a/libavformat/asfdec_f.c +++ b/libavformat/asfdec_f.c @@ -332,9 +332,9 @@ static int asf_read_stream_properties(AVFormatContext *s, uint64_t size) ASFStream *asf_st; ff_asf_guid g; enum AVMediaType type; - int type_specific_size, sizeX; - unsigned int tag1; - int64_t pos1, pos2, start_time; + unsigned int tag1, type_specific_size, sizeX; + int64_t pos1, pos2; + uint32_t start_time; int test_for_ext_stream_audio, is_dvr_ms_audio = 0; if (s->nb_streams == ASF_MAX_STREAMS) { @@ -403,7 +403,14 @@ static int asf_read_stream_properties(AVFormatContext *s, uint64_t size) st->codecpar->codec_type = type; if (type == AVMEDIA_TYPE_AUDIO) { - int ret = ff_get_wav_header(s, pb, st->codecpar, type_specific_size, 0); + int ret; + + if (type_specific_size > INT32_MAX) { + av_log(s, AV_LOG_DEBUG, "Unsupported WAV header size (> INT32_MAX)\n"); + return AVERROR(ENOTSUP); + } + + ret = ff_get_wav_header(s, pb, st->codecpar, (int)type_specific_size, 0); if (ret < 0) return ret; if (is_dvr_ms_audio) { @@ -433,21 +440,32 @@ static int asf_read_stream_properties(AVFormatContext *s, uint64_t size) } } else if (type == AVMEDIA_TYPE_VIDEO && size - (avio_tell(pb) - pos1 + 24) >= 51) { + unsigned int width, height; avio_rl32(pb); avio_rl32(pb); avio_r8(pb); avio_rl16(pb); /* size */ - sizeX = avio_rl32(pb); /* size */ - st->codecpar->width = avio_rl32(pb); - st->codecpar->height = avio_rl32(pb); + sizeX = avio_rl32(pb); /* size */ + width = avio_rl32(pb); + height = avio_rl32(pb); + + if (width > INT32_MAX || height > INT32_MAX) { + av_log(s, AV_LOG_DEBUG, "Unsupported video size %dx%d\n", width, height); + return AVERROR(ENOTSUP); + } + + st->codecpar->width = (int)width; + st->codecpar->height = (int)height; /* not available for asf */ avio_rl16(pb); /* panes */ st->codecpar->bits_per_coded_sample = avio_rl16(pb); /* depth */ tag1 = avio_rl32(pb); avio_skip(pb, 20); if (sizeX > 40) { - if (size < sizeX - 40 || sizeX - 40 > INT_MAX - AV_INPUT_BUFFER_PADDING_SIZE) - return AVERROR_INVALIDDATA; + if (size < sizeX - 40 || sizeX - 40 > INT_MAX - AV_INPUT_BUFFER_PADDING_SIZE) { + av_log(s, AV_LOG_DEBUG, "Unsupported extradata size\n"); + return AVERROR(ENOTSUP); + } st->codecpar->extradata_size = ffio_limit(pb, sizeX - 40); st->codecpar->extradata = av_mallocz(st->codecpar->extradata_size + AV_INPUT_BUFFER_PADDING_SIZE); @@ -499,9 +517,9 @@ static int asf_read_ext_stream_properties(AVFormatContext *s) ASFContext *asf = s->priv_data; AVIOContext *pb = s->pb; ff_asf_guid g; - int ext_len, payload_ext_ct, stream_ct, i; - uint32_t leak_rate, stream_num; - unsigned int stream_languageid_index; + uint16_t payload_ext_ct, stream_ct, i; + uint32_t leak_rate, ext_len; + uint16_t stream_languageid_index, stream_num; avio_rl64(pb); // starttime avio_rl64(pb); // endtime @@ -513,15 +531,15 @@ static int asf_read_ext_stream_properties(AVFormatContext *s) avio_rl32(pb); // alt-init-bucket-fullness avio_rl32(pb); // max-object-size avio_rl32(pb); // flags (reliable,seekable,no_cleanpoints?,resend-live-cleanpoints, rest of bits reserved) - stream_num = avio_rl16(pb); // stream-num + stream_num = (uint16_t)avio_rl16(pb); // stream-num - stream_languageid_index = avio_rl16(pb); // stream-language-id-index + stream_languageid_index = (uint16_t)avio_rl16(pb); // stream-language-id-index if (stream_num < 128) asf->streams[stream_num].stream_language_index = stream_languageid_index; avio_rl64(pb); // avg frametime in 100ns units - stream_ct = avio_rl16(pb); // stream-name-count - payload_ext_ct = avio_rl16(pb); // payload-extension-system-count + stream_ct = (uint16_t)avio_rl16(pb); // stream-name-count + payload_ext_ct = (uint16_t)avio_rl16(pb); // payload-extension-system-count if (stream_num < 128) { asf->stream_bitrates[stream_num] = leak_rate; @@ -535,12 +553,10 @@ static int asf_read_ext_stream_properties(AVFormatContext *s) } for (i = 0; i < payload_ext_ct; i++) { - int size; + uint16_t size; ff_get_guid(pb, &g); - size = avio_rl16(pb); + size = (uint16_t)avio_rl16(pb); ext_len = avio_rl32(pb); - if (ext_len < 0) - return AVERROR_INVALIDDATA; avio_skip(pb, ext_len); if (stream_num < 128 && i < FF_ARRAY_ELEMS(asf->streams[stream_num].payload)) { ASFPayload *p = &asf->streams[stream_num].payload[i]; @@ -577,20 +593,21 @@ static int asf_read_ext_content_desc(AVFormatContext *s) { AVIOContext *pb = s->pb; ASFContext *asf = s->priv_data; - int desc_count, i, ret; + uint16_t desc_count, i; + int ret; - desc_count = avio_rl16(pb); + desc_count = (uint16_t)avio_rl16(pb); for (i = 0; i < desc_count; i++) { - int name_len, value_type, value_len; + uint16_t name_len, value_type, value_len; char name[1024]; - name_len = avio_rl16(pb); + name_len = (uint16_t)avio_rl16(pb); if (name_len % 2) // must be even, broken lavf versions wrote len-1 name_len += 1; if ((ret = avio_get_str16le(pb, name_len, name, sizeof(name))) < name_len) avio_skip(pb, name_len - ret); - value_type = avio_rl16(pb); - value_len = avio_rl16(pb); + value_type = (uint16_t)avio_rl16(pb); + value_len = (uint16_t)avio_rl16(pb); if (!value_type && value_len % 2) value_len += 1; /* My sample has that stream set to 0 maybe that mean the container. @@ -623,14 +640,16 @@ static int asf_read_language_list(AVFormatContext *s) { AVIOContext *pb = s->pb; ASFContext *asf = s->priv_data; - int j, ret; - int stream_count = avio_rl16(pb); + int ret; + uint16_t j; + const uint16_t stream_count = (uint16_t)avio_rl16(pb); + for (j = 0; j < stream_count; j++) { char lang[6]; - unsigned int lang_len = avio_r8(pb); + const uint8_t lang_len = (uint8_t)avio_r8(pb); if ((ret = avio_get_str16le(pb, lang_len, lang, sizeof(lang))) < lang_len) - avio_skip(pb, lang_len - ret); + avio_skip(pb, (int)lang_len - ret); if (j < 128) av_strlcpy(asf->stream_languages[j], lang, sizeof(*asf->stream_languages)); @@ -643,14 +662,14 @@ static int asf_read_metadata(AVFormatContext *s) { AVIOContext *pb = s->pb; ASFContext *asf = s->priv_data; - int n, name_len_utf8; - uint16_t stream_num, name_len_utf16, value_type; + int name_len_utf8; + uint16_t stream_num, name_len_utf16, value_type, i, n; uint32_t value_len; - int ret, i; - n = avio_rl16(pb); + int ret; + n = (uint16_t)avio_rl16(pb); for (i = 0; i < n; i++) { - uint8_t *name; + char *name; avio_rl16(pb); // lang_list_index stream_num = (uint16_t)avio_rl16(pb); @@ -664,7 +683,7 @@ static int asf_read_metadata(AVFormatContext *s) return AVERROR(ENOMEM); if ((ret = avio_get_str16le(pb, name_len_utf16, name, name_len_utf8)) < name_len_utf16) - avio_skip(pb, name_len_utf16 - ret); + avio_skip(pb, (int)name_len_utf16 - ret); av_log(s, AV_LOG_TRACE, "%d stream %d name_len %2d type %d len %4d <%s>\n", i, stream_num, name_len_utf16, value_type, value_len, name); @@ -697,19 +716,21 @@ static int asf_read_marker(AVFormatContext *s) { AVIOContext *pb = s->pb; ASFContext *asf = s->priv_data; - int i, count, name_len, ret; + int ret; + unsigned count, i; + uint16_t name_len; char name[1024]; avio_rl64(pb); // reserved 16 bytes avio_rl64(pb); // ... count = avio_rl32(pb); // markers count avio_rl16(pb); // reserved 2 bytes - name_len = avio_rl16(pb); // name length + name_len = (uint16_t)avio_rl16(pb); // name length avio_skip(pb, name_len); for (i = 0; i < count; i++) { - int64_t pres_time; - int name_len; + uint64_t pres_time; + unsigned name2_len; if (avio_feof(pb)) return AVERROR_INVALIDDATA; @@ -720,13 +741,18 @@ static int asf_read_marker(AVFormatContext *s) avio_rl16(pb); // entry length avio_rl32(pb); // send time avio_rl32(pb); // flags - name_len = avio_rl32(pb); // name length - if ((unsigned)name_len > INT_MAX / 2) + name2_len = avio_rl32(pb); // name length + if (name2_len > INT_MAX / 2) return AVERROR_INVALIDDATA; - if ((ret = avio_get_str16le(pb, name_len * 2, name, - sizeof(name))) < name_len) - avio_skip(pb, name_len - ret); - avpriv_new_chapter(s, i, (AVRational) { 1, 10000000 }, pres_time, + if ((ret = avio_get_str16le(pb, (int)name2_len, name, + sizeof(name))) < name2_len) + avio_skip(pb, name2_len - ret); + + if (pres_time > INT64_MAX) { + av_log(s, AV_LOG_DEBUG, "Unsupported presentation time value: %"PRIu64"\n", pres_time); + return AVERROR(ENOTSUP); + } + avpriv_new_chapter(s, i, (AVRational) { 1, 10000000 }, (int64_t)pres_time, AV_NOPTS_VALUE, name); } @@ -739,7 +765,7 @@ static int asf_read_header(AVFormatContext *s) ff_asf_guid g; AVIOContext *pb = s->pb; int i; - int64_t gsize; + uint64_t gsize; ff_get_guid(pb, &g); if (ff_guidcmp(&g, &ff_asf_header)) @@ -754,7 +780,7 @@ static int asf_read_header(AVFormatContext *s) asf->streams[i].stream_language_index = 128; // invalid stream index means no language info for (;;) { - uint64_t gpos = avio_tell(pb); + const int64_t gpos = avio_tell(pb); int ret = 0; ff_get_guid(pb, &g); gsize = avio_rl64(pb); @@ -809,7 +835,12 @@ static int asf_read_header(AVFormatContext *s) len= avio_rl32(pb); av_log(s, AV_LOG_DEBUG, "Secret data:\n"); - if ((ret = av_get_packet(pb, pkt, len)) < 0) + if (len > INT32_MAX) { + av_log(s, AV_LOG_DEBUG, "Unsupported encryption packet length: %d\n", len); + return AVERROR(ENOTSUP); + } + + if ((ret = av_get_packet(pb, pkt, (int)len)) < 0) return ret; av_hex_dump_log(s, AV_LOG_DEBUG, pkt->data, pkt->size); av_packet_unref(pkt); @@ -923,7 +954,7 @@ static int asf_read_header(AVFormatContext *s) static int asf_get_packet(AVFormatContext *s, AVIOContext *pb) { ASFContext *asf = s->priv_data; - uint32_t packet_length, padsize; + uint32_t packet_length, packet_ts, padsize; int rsize = 8; int c, d, e, off; @@ -1011,7 +1042,12 @@ static int asf_get_packet(AVFormatContext *s, AVIOContext *pb) return AVERROR_INVALIDDATA; } - asf->packet_timestamp = avio_rl32(pb); + packet_ts = avio_rl32(pb); + if (packet_ts > INT32_MAX) { + av_log(s, AV_LOG_DEBUG, "Unsupported packet_timestamp value: %d\n", packet_ts); + return AVERROR(ENOTSUP); + } + asf->packet_timestamp = (int)packet_ts; avio_rl16(pb); /* duration */ // rsize has at least 11 bytes which have to be present @@ -1030,10 +1066,21 @@ static int asf_get_packet(AVFormatContext *s, AVIOContext *pb) rsize, packet_length, padsize, avio_tell(pb)); return AVERROR_INVALIDDATA; } - asf->packet_size_left = packet_length - padsize - rsize; + + if (packet_length - padsize - rsize > INT32_MAX) { + av_log(s, AV_LOG_DEBUG, "Unsupported packet_size_left value: %d\n", packet_length - padsize - rsize); + return AVERROR(ENOTSUP); + } + asf->packet_size_left = (int)(packet_length - padsize - rsize); + if (packet_length < asf->hdr.min_pktsize) padsize += asf->hdr.min_pktsize - packet_length; - asf->packet_padsize = padsize; + if (padsize > INT32_MAX) { + av_log(s, AV_LOG_DEBUG, "Unsupported packet padsize value: %d\n", padsize); + return AVERROR(ENOTSUP); + } + + asf->packet_padsize = (int)padsize; av_log(s, AV_LOG_TRACE, "packet: size=%d padsize=%d left=%d\n", s->packet_size, asf->packet_padsize, asf->packet_size_left); return 0; @@ -1068,22 +1115,23 @@ static int asf_read_frame_header(AVFormatContext *s, AVIOContext *pb) return AVERROR_INVALIDDATA; } if (asf->packet_replic_size >= 8) { - int64_t end = avio_tell(pb) + asf->packet_replic_size; + const int64_t end = avio_tell(pb) + asf->packet_replic_size; AVRational aspect; - asfst->packet_obj_size = avio_rl32(pb); - if (asfst->packet_obj_size >= (1 << 24) || asfst->packet_obj_size < 0) { + const unsigned packet_obj_size = avio_rl32(pb); + if (packet_obj_size >= (1 << 24)) { av_log(s, AV_LOG_ERROR, "packet_obj_size %d invalid\n", asfst->packet_obj_size); asfst->packet_obj_size = 0; return AVERROR_INVALIDDATA; } + asfst->packet_obj_size = (int)packet_obj_size; asf->packet_frag_timestamp = avio_rl32(pb); // timestamp for (i = 0; i < asfst->payload_ext_ct; i++) { ASFPayload *p = &asfst->payload[i]; - int size = p->size; + uint16_t size = p->size; int64_t payend; if (size == 0xFFFF) - size = avio_rl16(pb); + size = (uint16_t)avio_rl16(pb); payend = avio_tell(pb) + size; if (payend > end) { av_log(s, AV_LOG_ERROR, "too long payload\n"); @@ -1484,7 +1532,7 @@ static int64_t asf_read_pts(AVFormatContext *s, int stream_index, ASFStream *asf_st; int64_t pts; int64_t pos = *ppos; - int i; + unsigned i; int64_t start_pos[ASF_MAX_STREAMS]; for (i = 0; i < s->nb_streams; i++) @@ -1541,7 +1589,7 @@ static int asf_build_simple_index(AVFormatContext *s, int stream_index) int64_t ret; if((ret = avio_seek(s->pb, asf->data_object_offset + asf->data_object_size, SEEK_SET)) < 0) { - return ret; + return (int)ret; } if ((ret = ff_get_guid(s->pb, &g)) < 0)