[FFmpeg-devel] [PATCH] make packet_size in AVFormatContext unsigned

[Ronald S. Bultje]

Hi,

On Tue, Jun 16, 2009 at 5:39 PM, Michael Niedermayer <michaelni at gmx.at>wrote:

> On Tue, Jun 16, 2009 at 05:24:01PM -0400, Ronald S. Bultje wrote:
> > It changes the behaviour of buggy code, that's exactly why I mentioned
> it.
> > Could you comment on the suggested ways of fixing this bug in my original
> > email, or could you maybe elaborate on how you would like to see this bug
> > fixed? Do you agree that bug is there?
>
> i dont really care how its fixed but it should be fixed not wierdly
> disscussed how it changes through the type change


But how? I wouldn't know what reasonable min/max packet sizes of mpeg
streams are.

Patch with random numbers attached: min=32bytes (packet header is 10 bytes
for mpeg2, 8 bytes for mpeg1, and the flush_packet() function makes the
assumption that the value is at least 10 bytes higher than this (?), so the
code assumes that packet_size>=20, so 20 minimal, I took the closest higher
power-of-two); max=1MB (completely random).

Ronald
-------------- next part --------------
Index: ffmpeg-svn/libavformat/mpegenc.c
===================================================================
--- ffmpeg-svn.orig/libavformat/mpegenc.c	2009-06-16 18:06:50.000000000 -0400
+++ ffmpeg-svn/libavformat/mpegenc.c	2009-06-16 18:07:00.000000000 -0400
@@ -304,9 +304,14 @@
                    (CONFIG_MPEG2SVCD_MUXER && ctx->oformat == &mpeg2svcd_muxer));
     s->is_dvd =    (CONFIG_MPEG2DVD_MUXER  && ctx->oformat == &mpeg2dvd_muxer);
 
-    if(ctx->packet_size)
+    if(ctx->packet_size) {
+        if (ctx->packet_size < 32 || ctx->packet_size > (1<<20)) {
+            av_log(ctx, AV_LOG_ERROR, "Invalid packet size %d\n",
+                   ctx->packet_size);
+            goto fail;
+        }
         s->packet_size = ctx->packet_size;
-    else
+    } else
         s->packet_size = 2048;
 
     s->vcd_padding_bytes_written = 0;