[FFmpeg-devel] [PATCH] Vorbis-in-Ogg: Do not set timebase to invalid values

[Måns Rullgård]

Janne Grunau <janne-ffmpeg at jannau.net> writes:

> From: Reimar D?ffinger <Reimar.Doeffinger at gmx.de>
>
> cherry picked from git.videolan.org repo
>
> Janne
> ---8<---
> Avoids an assert when the sample rate is invalid and the timebase
> is thus set to e.g. 1/0.
> Sample file is http://samples.mplayerhq.hu/ogg/fuzzed-srate-crash.ogg
> ---
>  libavformat/oggparsevorbis.c |   10 +++++++---
>  1 files changed, 7 insertions(+), 3 deletions(-)
>
> diff --git a/libavformat/oggparsevorbis.c b/libavformat/oggparsevorbis.c
> index cdb0266..d743d25 100644
> --- a/libavformat/oggparsevorbis.c
> +++ b/libavformat/oggparsevorbis.c
> @@ -221,6 +221,7 @@ vorbis_header (AVFormatContext * s, int idx)
>      if (os->buf[os->pstart] == 1) {
>          const uint8_t *p = os->buf + os->pstart + 7; /* skip "\001vorbis" tag */
>          unsigned blocksize, bs0, bs1;
> +        int srate;
>
>          if (os->psize != 30)
>              return -1;
> @@ -229,7 +230,7 @@ vorbis_header (AVFormatContext * s, int idx)
>              return -1;
>
>          st->codec->channels = bytestream_get_byte(&p);
> -        st->codec->sample_rate = bytestream_get_le32(&p);
> +        srate = bytestream_get_le32(&p);
>          p += 4; // skip maximum bitrate
>          st->codec->bit_rate = bytestream_get_le32(&p); // nominal bitrate
>          p += 4; // skip minimum bitrate
> @@ -249,8 +250,11 @@ vorbis_header (AVFormatContext * s, int idx)
>          st->codec->codec_type = AVMEDIA_TYPE_AUDIO;
>          st->codec->codec_id = CODEC_ID_VORBIS;
>
> -        st->time_base.num = 1;
> -        st->time_base.den = st->codec->sample_rate;
> +        if (srate > 0) {
> +            st->codec->sample_rate = srate;
> +            st->time_base.num = 1;
> +            st->time_base.den = srate;
> +        }
>      } else if (os->buf[os->pstart] == 3) {
>          if (os->psize > 8)
>              ff_vorbis_comment (s, &st->metadata, os->buf + os->pstart + 7, os->psize - 8);
> -- 
> 1.7.4.rc2

I still want to know why common code doesn't catch this.  Replicating
this check in each and every demuxer is insane.

-- 
M?ns Rullg?rd
mans at mansr.com