[FFmpeg-devel] [PATCH 09/12] avformat/mxfdec: add support for clip wrapped essences

[Marton Balint]

On Tue, 12 Jun 2018, Michael Niedermayer wrote:

> On Tue, Jun 12, 2018 at 10:47:24AM +0200, Marton Balint wrote:
>>
>>
>> On Tue, 12 Jun 2018, Michael Niedermayer wrote:
>>
>>> On Sun, Jun 10, 2018 at 12:36:47PM +0200, Marton Balint wrote:
>>>> Also use common code with opAtom.
>>>>
>>>> Fixes ticket #2776.
>>>> Partially fixes ticket #5671.
>>>> Fixes ticket #5866.
>>>>
>>>> Signed-off-by: Marton Balint <cus at passwd.hu>
>>>> ---
>>>> libavformat/mxfdec.c | 281 ++++++++++++++++++++++++---------------------------
>>>> 1 file changed, 130 insertions(+), 151 deletions(-)
>>>
>>> causes a segfault:
>>>
>>> ==23735== Invalid read of size 8
>>> ==23735==    at 0x75A627: mxf_set_pts (mxfdec.c:3277)
>>> ==23735==    by 0x75ACAD: mxf_read_packet_old (mxfdec.c:3396)
>>> ==23735==    by 0x7E099D: ff_read_packet (utils.c:856)
>>> ==23735==    by 0x7E39FF: read_frame_internal (utils.c:1581)
>>> ==23735==    by 0x7EB82B: avformat_find_stream_info (utils.c:3773)
>>> ==23735==    by 0x415534: open_input_file (ffmpeg_opt.c:1091)
>>> ==23735==    by 0x41EB11: open_files (ffmpeg_opt.c:3206)
>>> ==23735==    by 0x41ECA3: ffmpeg_parse_options (ffmpeg_opt.c:3246)
>>> ==23735==    by 0x43D1A3: main (ffmpeg.c:4832)
>>> ==23735==  Address 0x0 is not stack'd, malloc'd or (recently) free'd
>>> ==23735==
>>> ==23735==
>>> ==23735== Process terminating with default action of signal 11 (SIGSEGV)
>>> ==23735==  Access not within mapped region at address 0x0
>>> ==23735==    at 0x75A627: mxf_set_pts (mxfdec.c:3277)
>>> ==23735==    by 0x75ACAD: mxf_read_packet_old (mxfdec.c:3396)
>>> ==23735==    by 0x7E099D: ff_read_packet (utils.c:856)
>>> ==23735==    by 0x7E39FF: read_frame_internal (utils.c:1581)
>>> ==23735==    by 0x7EB82B: avformat_find_stream_info (utils.c:3773)
>>> ==23735==    by 0x415534: open_input_file (ffmpeg_opt.c:1091)
>>> ==23735==    by 0x41EB11: open_files (ffmpeg_opt.c:3206)
>>> ==23735==    by 0x41ECA3: ffmpeg_parse_options (ffmpeg_opt.c:3246)
>>> ==23735==    by 0x43D1A3: main (ffmpeg.c:4832)
>>> ==23735==  If you believe this happened as a result of a stack
>>> ==23735==  overflow in your program's main thread (unlikely but
>>> ==23735==  possible), you can try to increase the size of the
>>> ==23735==  main thread stack using the --main-stacksize= flag.
>>> ==23735==  The main thread stack size used in this run was 8388608.
>>
>> I don't see this. What is your command line?
>
> testcase sent privatly

index_table->nb_ptses was negative, but that did not cause problems before 
the patch, because the comparison to nb_ptses was signed, after the patch 
it became unsigned.

It is better to explicitly disallow a negative nb_ptses, please apply the 
attached patch before this one, you should be good.

Thanks,
Marton
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-avformat-mxfdec-avoid-index_table-nb_ptses-overflow-.patch
Type: text/x-patch
Size: 1064 bytes
Desc: 
URL: <http://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20180612/b169aa1f/attachment.bin>