[FFmpeg-devel] [PATCH 1/3] ffmdec: reset packet_end in case of failure

[Michael Niedermayer]

On Sat, Jan 02, 2016 at 04:51:17PM +0100, Andreas Cadhalpun wrote:
> This fixes segmentation faults caused by passing a packet_ptr of NULL to
> memcpy.
> 
> Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun at googlemail.com>
> ---
>  libavformat/ffmdec.c | 8 ++++++--
>  1 file changed, 6 insertions(+), 2 deletions(-)
> 
> diff --git a/libavformat/ffmdec.c b/libavformat/ffmdec.c
> index 9fe4155..7b2d0d7 100644
> --- a/libavformat/ffmdec.c
> +++ b/libavformat/ffmdec.c
> @@ -123,8 +123,10 @@ static int ffm_read_data(AVFormatContext *s,
>              frame_offset = avio_rb16(pb);
>              avio_read(pb, ffm->packet, ffm->packet_size - FFM_HEADER_SIZE);
>              ffm->packet_end = ffm->packet + (ffm->packet_size - FFM_HEADER_SIZE - fill_size);
> -            if (ffm->packet_end < ffm->packet || frame_offset < 0)
> +            if (ffm->packet_end < ffm->packet || frame_offset < 0) {
> +                ffm->packet_end = ffm->packet_ptr;

doesnt this imply that packet_end was set to a invalid pointer?
(that is undefined behavior)


>                  return -1;
> +            }
>              /* if first packet or resynchronization packet, we must
>                 handle it specifically */
>              if (ffm->first_packet || (frame_offset & 0x8000)) {
> @@ -140,8 +142,10 @@ static int ffm_read_data(AVFormatContext *s,
>                      return 0;
>                  }
>                  ffm->first_packet = 0;
> -                if ((frame_offset & 0x7fff) < FFM_HEADER_SIZE)
> +                if ((frame_offset & 0x7fff) < FFM_HEADER_SIZE) {
> +                    ffm->packet_end = ffm->packet_ptr;
>                      return -1;
> +                }
>                  ffm->packet_ptr = ffm->packet + (frame_offset & 0x7fff) - FFM_HEADER_SIZE;
>                  if (!header)
>                      break;
> -- 
> 2.6.4
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel at ffmpeg.org
> http://ffmpeg.org/mailman/listinfo/ffmpeg-devel

-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Those who are too smart to engage in politics are punished by being
governed by those who are dumber. -- Plato 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 181 bytes
Desc: Digital signature
URL: <http://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20160102/dac1b6b4/attachment.sig>