[FFmpeg-trac] #4038(undetermined:new): avio_seek gets called with (..., -1, SEEK_SET)

FFmpeg trac at avcodec.org
Thu Oct 16 18:34:01 CEST 2014


#4038: avio_seek gets called with (..., -1, SEEK_SET)
-------------------------------------+-------------------------------------
             Reporter:  albertzeyer  |                     Type:  defect
               Status:  new          |                 Priority:  normal
            Component:               |                  Version:
  undetermined                       |  unspecified
             Keywords:               |               Blocked By:
             Blocking:               |  Reproduced by developer:  0
Analyzed by developer:  0            |
-------------------------------------+-------------------------------------
 In `libavformat/mp3dec.c`, the bug is in `mp3_seek`:

 {{{
 static int check(AVFormatContext *s, int64_t pos)
 {
     int64_t ret = avio_seek(s->pb, pos, SEEK_SET);
 ...
 }
 ...
 static int mp3_seek(...)
 {
 ...
     best_pos = ie->pos;
     best_score = 999;
     for(i=0; i<4096; i++) {
         int64_t pos = ie->pos + (dir > 0 ? i - 1024 : -i);
         int64_t candidate = -1;
         int score = 999;
         for(j=0; j<MIN_VALID; j++) {
             ret = check(s, pos);
 ...
 }}}

 I have the case where `ie->pos` is small. In that case, negative values
 can land in `pos` and will get passed over to `avio_seek`.

--
Ticket URL: <https://trac.ffmpeg.org/ticket/4038>
FFmpeg <https://ffmpeg.org>
FFmpeg issue tracker


More information about the FFmpeg-trac mailing list