[FFmpeg-trac] #4038(undetermined:new): avio_seek gets called with (..., -1, SEEK_SET)
FFmpeg
trac at avcodec.org
Thu Oct 16 18:34:01 CEST 2014
#4038: avio_seek gets called with (..., -1, SEEK_SET)
-------------------------------------+-------------------------------------
Reporter: albertzeyer | Type: defect
Status: new | Priority: normal
Component: | Version:
undetermined | unspecified
Keywords: | Blocked By:
Blocking: | Reproduced by developer: 0
Analyzed by developer: 0 |
-------------------------------------+-------------------------------------
In `libavformat/mp3dec.c`, the bug is in `mp3_seek`:
{{{
static int check(AVFormatContext *s, int64_t pos)
{
int64_t ret = avio_seek(s->pb, pos, SEEK_SET);
...
}
...
static int mp3_seek(...)
{
...
best_pos = ie->pos;
best_score = 999;
for(i=0; i<4096; i++) {
int64_t pos = ie->pos + (dir > 0 ? i - 1024 : -i);
int64_t candidate = -1;
int score = 999;
for(j=0; j<MIN_VALID; j++) {
ret = check(s, pos);
...
}}}
I have the case where `ie->pos` is small. In that case, negative values
can land in `pos` and will get passed over to `avio_seek`.
--
Ticket URL: <https://trac.ffmpeg.org/ticket/4038>
FFmpeg <https://ffmpeg.org>
FFmpeg issue tracker
More information about the FFmpeg-trac
mailing list