[FFmpeg-cvslog] r19973 - trunk/libavcodec/utils.c

[Reimar Döffinger]

On Thu, Oct 01, 2009 at 08:47:13AM +0200, Reimar D?ffinger wrote:
> On Wed, Sep 30, 2009 at 11:09:36PM -0700, Baptiste Coudurier wrote:
> > On 9/22/09 3:44 PM, michael wrote:
> > > Author: michael
> > > Date: Wed Sep 23 00:44:56 2009
> > > New Revision: 19973
> > >
> > > Log:
> > > Check codec_id and codec_type in avcodec_open(), based on 43_codec_type_mismatch.patch from chrome
> > > This is said to be able to lead to a stack based buffer overflow.
> > >
> > > Modified:
> > >     trunk/libavcodec/utils.c
> > >
> > > Modified: trunk/libavcodec/utils.c
> > > ==============================================================================
> > > --- trunk/libavcodec/utils.c	Tue Sep 22 22:38:03 2009	(r19972)
> > > +++ trunk/libavcodec/utils.c	Wed Sep 23 00:44:56 2009	(r19973)
> > > @@ -481,7 +481,10 @@ int attribute_align_arg avcodec_open(AVC
> > >       }
> > >
> > >       avctx->codec = codec;
> > > -    avctx->codec_id = codec->id;
> > > +    if(avctx->codec_id != codec->id || avctx->codec_type != codec->type){
> > > +        av_log(avctx, AV_LOG_ERROR, "codec type or id mismatches\n");
> > > +        goto end;
> > > +    }
> > >       avctx->frame_number = 0;
> > >       if(avctx->codec->init){
> > >           ret = avctx->codec->init(avctx);
> > 
> > It seems that quite some users are complaining about this change.
> > What do we do ?
> 
> Is there any issue with doing
> if (avctx->codec_id == CODEC_ID_UNKNOWN && avctx->codec_type == CODEC_TYPE_UNKNOWN)
> {
>     avctx->codec_id = codec->id;
>     avctx->codec_type = codec->type;
> }
> ?

Or more precisely this, it fixes the MPlayer GUI at least and probably
almost anything else:
Index: utils.c
===================================================================
--- utils.c     (revision 20105)
+++ utils.c     (working copy)
@@ -480,6 +480,11 @@
     }
 
     avctx->codec = codec;
+    if(avctx->codec_id == CODEC_ID_NONE
+       && (avctx->codec_type == CODEC_TYPE_UNKNOWN || avctx->codec_type == codec->type)) {
+        avctx->codec_id = codec->id;
+        avctx->codec_type = codec->type;
+    }
     if(avctx->codec_id != codec->id || avctx->codec_type != codec->type){
         av_log(avctx, AV_LOG_ERROR, "codec type or id mismatches\n");
         goto free_and_end;