[FFmpeg-devel] [PATCH] avformat/movenc: Check input sample count

[Michael Niedermayer]

On Fri, Jul 06, 2018 at 02:24:45PM -0700, Baptiste Coudurier wrote:
> Hi Michael,
> 
> On Fri, Jul 6, 2018 at 2:09 PM, Michael Niedermayer <michael at niedermayer.cc>
> wrote:
> 
> > Fixes: division by 0
> > Fixes: fpe_movenc.c_199_1.wav
> > Fixes: fpe_movenc.c_199_2.wav
> > Fixes: fpe_movenc.c_199_3.wav
> > Fixes: fpe_movenc.c_199_4.wav
> > Fixes: fpe_movenc.c_199_5.wav
> > Fixes: fpe_movenc.c_199_6.wav
> > Fixes: fpe_movenc.c_199_7.wav
> >
> > Found-by: #CHEN HONGXU# <HCHEN017 at e.ntu.edu.sg>
> > Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> > ---
> >  libavformat/movenc.c | 5 +++++
> >  1 file changed, 5 insertions(+)
> >
> > diff --git a/libavformat/movenc.c b/libavformat/movenc.c
> > index fe0a244a8f..78291a9adc 100644
> > --- a/libavformat/movenc.c
> > +++ b/libavformat/movenc.c
> > @@ -5269,6 +5269,11 @@ int ff_mov_write_packet(AVFormatContext *s,
> > AVPacket *pkt)
> >      else
> >          samples_in_chunk = 1;
> >
> > +    if (samples_in_chunk < 1) {
> > +        av_log(s, AV_LOG_ERROR, "fatal error, input packet contains no
> > samples\n");
> > +        return AVERROR_PATCHWELCOME;
> > +    }
> > +
> 
> 
> Since "samples_in_chunk" is set to 1 just above, maybe the check can be
> moved earlier ?

the code before the else contains a few else if()
from a quick look it seems plausible that multiple could reach 
samples_in_chunk=0


[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

If you fake or manipulate statistics in a paper in physics you will never
get a job again.
If you fake or manipulate statistics in a paper in medicin you will get
a job for life at the pharma industry.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 181 bytes
Desc: not available
URL: <http://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20180707/7f334de3/attachment.sig>