[FFmpeg-devel] [Patch] fix ffprobe crash #3603

[Clément Bœsch]

On Fri, May 09, 2014 at 12:33:36PM +0530, anshul wrote:
> On 05/09/2014 06:15 AM, Michael Niedermayer wrote:
> >>this patch consider all three things.
> >did you intend to attach anoter patch ?
> >iam asking as there was no patch attached to your last mail
> >
> >
> yes, I am sorry for that.
> 
> -Anshul

> From 3ee1e369b42f0baa29706739f0b328615d20ebee Mon Sep 17 00:00:00 2001
> From: Anshul Maheshwari <er.anshul.maheshwari at gmail.com>
> Date: Thu, 8 May 2014 12:23:26 +0530
> Subject: [PATCH] ffprobe: fix crash because of new streams occuring
> 
> Fix ticket #3603
> ---
>  ffprobe.c | 19 ++++++++++++++-----
>  1 file changed, 14 insertions(+), 5 deletions(-)
> 
> diff --git a/ffprobe.c b/ffprobe.c
> index c6e0469..5d6bf01 100644
> --- a/ffprobe.c
> +++ b/ffprobe.c
> @@ -191,6 +191,7 @@ static const char unit_hertz_str[]          = "Hz"   ;
>  static const char unit_byte_str[]           = "byte" ;
>  static const char unit_bit_per_second_str[] = "bit/s";
>  
> +static int nb_streams;
>  static uint64_t *nb_streams_packets;
>  static uint64_t *nb_streams_frames;
>  static int *selected_streams;
> @@ -1893,6 +1894,12 @@ static int read_interval_packets(WriterContext *w, AVFormatContext *fmt_ctx,
>          goto end;
>      }
>      while (!av_read_frame(fmt_ctx, &pkt)) {
> +        if(fmt_ctx->nb_streams >= nb_streams) {
> +            nb_streams_frames  = av_realloc(nb_streams_frames,fmt_ctx->nb_streams* sizeof(*nb_streams_frames));
> +            nb_streams_packets = av_realloc(nb_streams_packets,fmt_ctx->nb_streams* sizeof(*nb_streams_packets));
> +            selected_streams   = av_realloc(selected_streams,fmt_ctx->nb_streams* sizeof(*selected_streams));

space after ,
space before *
space before (

also, more importantly: the new allocated space is not initialized

> +            nb_streams = fmt_ctx->nb_streams;
> +        }
>          if (selected_streams[pkt.stream_index]) {
>              AVRational tb = fmt_ctx->streams[pkt.stream_index]->time_base;
>  
> @@ -1920,7 +1927,9 @@ static int read_interval_packets(WriterContext *w, AVFormatContext *fmt_ctx,
>              if (do_read_packets) {
>                  if (do_show_packets)
>                      show_packet(w, fmt_ctx, &pkt, i++);
> -                nb_streams_packets[pkt.stream_index]++;
> +                if(nb_streams_packets) {

space before (
nit: no need for { }

> +                    nb_streams_packets[pkt.stream_index]++;
> +                }
>              }
>              if (do_read_frames) {
>                  pkt1 = pkt;
> @@ -2373,10 +2382,10 @@ static int probe_file(WriterContext *wctx, const char *filename)
>          return ret;
>  
>  #define CHECK_END if (ret < 0) goto end
> -
> -    nb_streams_frames  = av_calloc(fmt_ctx->nb_streams, sizeof(*nb_streams_frames));
> -    nb_streams_packets = av_calloc(fmt_ctx->nb_streams, sizeof(*nb_streams_packets));
> -    selected_streams   = av_calloc(fmt_ctx->nb_streams, sizeof(*selected_streams));
> +    nb_streams = fmt_ctx->nb_streams;
> +    nb_streams_frames  = av_realloc(NULL,fmt_ctx->nb_streams* sizeof(*nb_streams_frames));
> +    nb_streams_packets = av_realloc(NULL,fmt_ctx->nb_streams* sizeof(*nb_streams_packets));
> +    selected_streams   = av_realloc(NULL,fmt_ctx->nb_streams* sizeof(*selected_streams));

space after ,
space before *

also, memory is not not initialized anymore.

[...]

-- 
Clément B.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 490 bytes
Desc: not available
URL: <https://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20140509/9a37a549/attachment.asc>