[FFmpeg-devel] [PATCH v6 4/4] lavf/utils: Normalize AVPacket.data to native endian

[Michael Niedermayer]

On Fri, Mar 04, 2016 at 03:08:48AM +0100, Mats Peterson wrote:
> 
> -- 
> Mats Peterson
> http://matsp888.no-ip.org/~mats/

>  internal.h |    5 +++--
>  utils.c    |   16 ++++++++++++----
>  2 files changed, 15 insertions(+), 6 deletions(-)
> 10668c891a2fe1b1d311e6c48870ed3ef2967edc  0004-lavf-utils-Normalize-AVPacket.data-to-native-endian.patch
> From 47d09853998e30e486b0069223a90d80e7742499 Mon Sep 17 00:00:00 2001
> From: Mats Peterson <matsp888 at yahoo.com>
> Date: Fri, 4 Mar 2016 02:57:59 +0100
> Subject: [PATCH v6 4/4] lavf/utils: Normalize AVPacket.data to native endian
> 
> ---
>  libavformat/internal.h |    5 +++--
>  libavformat/utils.c    |   16 ++++++++++++----
>  2 files changed, 15 insertions(+), 6 deletions(-)
> 
> diff --git a/libavformat/internal.h b/libavformat/internal.h
> index 63e0632..fe95009 100644
> --- a/libavformat/internal.h
> +++ b/libavformat/internal.h
> @@ -588,9 +588,10 @@ int ff_reshuffle_raw_rgb(AVFormatContext *s, AVPacket **ppkt, AVCodecContext *en
>   *
>   * Use 0 for the ret parameter to check for side data only.
>   *
> - * @param pkt pointer to the packet before calling ff_reshuffle_raw_rgb()
> + * @param pkt pointer to packet before calling ff_reshuffle_raw_rgb()
>   * @param ret return value from ff_reshuffle_raw_rgb(), or 0
> + * @param palette pointer to pointer, which will be NULL if no palette found
>   */
> -int ff_get_packet_palette(AVFormatContext *s, AVPacket *pkt, int ret, const uint8_t **palette);
> +int ff_get_packet_palette(AVFormatContext *s, AVPacket *pkt, int ret, uint32_t **palette);
>  
>  #endif /* AVFORMAT_INTERNAL_H */
> diff --git a/libavformat/utils.c b/libavformat/utils.c
> index 85702dd..e66abcc 100644
> --- a/libavformat/utils.c
> +++ b/libavformat/utils.c
> @@ -4782,18 +4782,26 @@ int ff_standardize_creation_time(AVFormatContext *s)
>      return ret;
>  }
>  
> -int ff_get_packet_palette(AVFormatContext *s, AVPacket *pkt, int ret, const uint8_t **palette)
> +int ff_get_packet_palette(AVFormatContext *s, AVPacket *pkt, int ret, uint32_t **palette)
>  {
>      int size;
>  
> -    *palette = av_packet_get_side_data(pkt, AV_PKT_DATA_PALETTE, &size);
> +    *palette = (uint32_t *)av_packet_get_side_data(pkt, AV_PKT_DATA_PALETTE, &size);
>      if (*palette && size != AVPALETTE_SIZE) {
>          av_log(s, AV_LOG_ERROR, "Invalid palette side data\n");
>          return AVERROR_INVALIDDATA;
>      }
>  
> -    if (!*palette && ret == CONTAINS_PAL)
> -        *palette = pkt->data + pkt->size - AVPALETTE_SIZE;
> +    if (!*palette && ret == CONTAINS_PAL) {
> +        uint8_t *pkt_pal = pkt->data + pkt->size - AVPALETTE_SIZE;
> +        int i;
> +        for (i = 0; i < AVPALETTE_COUNT; i++) {
> +            uint8_t *p8 = pkt_pal + 4*i;

> +            uint32_t *p32 = (uint32_t *)p8;

undefined behavior, violating alignment requirements, and possibly
aliassing violation


> +            *p32 = AV_RL32(p8);

corrupting potenially shared or read only input packet

[...]


-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

During times of universal deceit, telling the truth becomes a
revolutionary act. -- George Orwell
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 181 bytes
Desc: Digital signature
URL: <http://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20160304/3b4f4763/attachment.sig>