[FFmpeg-devel] [PATCH 07/47] fftools/ffmpeg_mux_init: avoid invalid memory access in set_dispositions()

[Anton Khirnov]

This function assumes AVMEDIA_* are always positive, while in fact it
can also handle AVMEDIA_TYPE_UNKNOWN, which is -1.
---
 fftools/ffmpeg_mux_init.c | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/fftools/ffmpeg_mux_init.c b/fftools/ffmpeg_mux_init.c
index 03d60f2a19..cc5ec68040 100644
--- a/fftools/ffmpeg_mux_init.c
+++ b/fftools/ffmpeg_mux_init.c
@@ -2296,8 +2296,9 @@ static int set_dispositions(Muxer *mux, const OptionsContext *o)
     OutputFile                    *of = &mux->of;
     AVFormatContext              *ctx = mux->fc;
 
-    int nb_streams[AVMEDIA_TYPE_NB]   = { 0 };
-    int have_default[AVMEDIA_TYPE_NB] = { 0 };
+    // indexed by type+1, because AVMEDIA_TYPE_UNKNOWN=-1
+    int nb_streams[AVMEDIA_TYPE_NB + 1]   = { 0 };
+    int have_default[AVMEDIA_TYPE_NB + 1] = { 0 };
     int have_manual = 0;
     int ret = 0;
 
@@ -2311,7 +2312,7 @@ static int set_dispositions(Muxer *mux, const OptionsContext *o)
     for (int i = 0; i < ctx->nb_streams; i++) {
         OutputStream *ost = of->streams[i];
 
-        nb_streams[ost->type]++;
+        nb_streams[ost->type + 1]++;
 
         MATCH_PER_STREAM_OPT(disposition, str, dispositions[i], ctx, ost->st);
 
@@ -2321,7 +2322,7 @@ static int set_dispositions(Muxer *mux, const OptionsContext *o)
             ost->st->disposition = ost->ist->st->disposition;
 
             if (ost->st->disposition & AV_DISPOSITION_DEFAULT)
-                have_default[ost->type] = 1;
+                have_default[ost->type + 1] = 1;
         }
     }
 
@@ -2346,12 +2347,12 @@ static int set_dispositions(Muxer *mux, const OptionsContext *o)
             OutputStream *ost = of->streams[i];
             enum AVMediaType type = ost->type;
 
-            if (nb_streams[type] < 2 || have_default[type] ||
+            if (nb_streams[type + 1] < 2 || have_default[type + 1] ||
                 ost->st->disposition & AV_DISPOSITION_ATTACHED_PIC)
                 continue;
 
             ost->st->disposition |= AV_DISPOSITION_DEFAULT;
-            have_default[type] = 1;
+            have_default[type + 1] = 1;
         }
     }
 
-- 
2.40.1