From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.ffmpeg.org (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTPS id 0EE1440059 for ; Thu, 18 Dec 2025 18:13:29 +0000 (UTC) Authentication-Results: ffbox; dkim=fail (body hash mismatch (got b'FObwg40xxPiXrvNDfDZe58gNRWz6FPkNpWLi1ukTbfQ=', expected b'qbOVxu4IH09RxEZX5ad0/zsu6WztP1LmCZSfJPo0rR4=')) header.d=ffmpeg.org header.i=@ffmpeg.org header.a=rsa-sha256 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ffmpeg.org; i=@ffmpeg.org; q=dns/txt; s=mail; t=1766081589; h=mime-version : to : date : message-id : reply-to : subject : list-id : list-archive : list-archive : list-help : list-owner : list-post : list-subscribe : list-unsubscribe : from : cc : content-type : content-transfer-encoding : from; bh=FObwg40xxPiXrvNDfDZe58gNRWz6FPkNpWLi1ukTbfQ=; b=jR3IGhvMtaV2i/lHt07iToYxqhOsLOJ9ZOhBbjtpZmtAWxfx+SCSCNrTUvsmyfZfWLJxR lIVQ5f+ob5whfrLp4GeKRvGT8XRaUPZ1mCWaqwP+nvJHQc7IKL2oZjp8yzPDqcWEO5a3Qjh 1skq/xs8SQoLUgSOVjj+b/cPG8NRp3zshOsf5LnhGjnKG7QVaySVLEZ+AF2AyYmMa4yWI8U WHLIIVzbdbQi77Wn7EI9MoDpntt292zHRLQOaVU+LOV+Wr2i08ZsZsYK6AStweBNWj6vfUb NR0Fv4Ay6tgYGdo3Ls+Iga0IrKYTZswkGC1/vcqvZu41RUndoIATrZp9I0sw== Received: from [172.20.0.2] (unknown [172.19.0.4]) by ffbox0-bg.ffmpeg.org (Postfix) with ESMTP id 061F4690998; Thu, 18 Dec 2025 20:13:09 +0200 (EET) ARC-Seal: i=1; cv=none; a=rsa-sha256; d=ffmpeg.org; s=arc; t=1766081582; b=oH/1PDs+H4BGNK07XNlNGj7iGzOITMUsUXbaMlVPa9wISIkchgvUGnwS65ynMAhpa3+VP xubyaU1PX8uk5LKHutQ0tG+xePu/zNjMnpINS8lOP9XcRdvRoAIBwr8N7Kt39/xTypj4xpk YpcKYqzX7BCnvNzuLyA5fnLP+H/c7y1FJPsXQNigmy32rm2G0t5hWecyp8l2p7Luijx7xpd 4AzE8D4Oa7CcUEVdoHZiRyM4iOvqdEfOlIko9BlIy19XQhWo26wAynzdyKrrV5mYcjdPl6B sThj8Mh+PXog4/qIkvKdIFNfKIel5KGgmXf/EfLfTTbNcNTK+/WdFABQW1aQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=ffmpeg.org; s=arc; t=1766081582; h=from : sender : reply-to : subject : date : message-id : to : cc : mime-version : content-type : content-transfer-encoding : content-id : content-description : resent-date : resent-from : resent-sender : resent-to : resent-cc : resent-message-id : in-reply-to : references : list-id : list-help : list-unsubscribe : list-subscribe : list-post : list-owner : list-archive; bh=+swJ0rs3bIZJ34CAI1GgX0NT/ndNXmggOZoIfRSkxng=; b=Xw503dq6tBZ3WhzAvw/N2p3gQIaw2LFRIxzyjh3D4/ZmCPANuvFqXyy/zRY2DsP3AKP/D HCiIKP9ZIcL9ok/t+POdQjX1QkvSTusRf30y6bgHBGrUSTnC04uRY7EDSPUyHYLyKcSzBRN XSiw14RjZF5dyvJMClBEWhH9XVCRF3pxgQenddhMJgGig+SHCThqJICRT4cyXgk8nbFWnPf 9et9s9tTV4Ji8a/hwKlqrSD/S8HyvrnhdtGJRydSBYvvaColf1PGqTn8tY0MqWbDEuA9Loe +SHHGrQsRykW7BbI5cLNS4RxYtipZ/V1hd3WRROwkCj6qRqCPbbKAnZyWb8g== ARC-Authentication-Results: i=1; ffmpeg.org; dkim=pass header.d=ffmpeg.org header.i=@ffmpeg.org; arc=none; dmarc=pass header.from=ffmpeg.org policy.dmarc=quarantine Authentication-Results: ffmpeg.org; dkim=pass header.d=ffmpeg.org header.i=@ffmpeg.org; arc=none (Message is not ARC signed); dmarc=pass (Used From Domain Record) header.from=ffmpeg.org policy.dmarc=quarantine DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ffmpeg.org; i=@ffmpeg.org; q=dns/txt; s=mail; t=1766081574; h=content-type : mime-version : content-transfer-encoding : from : to : reply-to : subject : date : from; bh=qbOVxu4IH09RxEZX5ad0/zsu6WztP1LmCZSfJPo0rR4=; b=T9fTt/WFQ3AneK90JFs2E/ggAD1wxBi7Ga9RFt6lfY3i5/i1llHazTorDhyoACe2EBnxC Uf5xRtisTEeTSLlf4sMXXHW0aXVJ9K0QDORFalLTcg6hVa19mbOaxQI1KsnRcoTdEhOn822 Uap3tIyAlPxFZ5gahHMlXPwBfobQLBl5FsVG1QqAxUhT44/qisaKs7FzFFluLbdmsEspPk8 3qUABnOxJDBRBdIdwFOstKEr4O8Hc62vM2BwTHSccc/KjMwRBCNGs4P9RSsJrwqvrlaV+lJ urmiRUKE2zY3+UC0v6xTSIjq+XW74u+utJ7QjX+qth8u7bB98TbFa4gikkBg== Received: from 55ca25703178 (code.ffmpeg.org [188.245.149.3]) by ffbox0-bg.ffmpeg.org (Postfix) with ESMTPS id 94B7B6909A3 for ; Thu, 18 Dec 2025 20:12:54 +0200 (EET) MIME-Version: 1.0 To: ffmpeg-devel@ffmpeg.org Date: Thu, 18 Dec 2025 18:12:54 -0000 Message-ID: <176608157478.60.13191221660969304830@2cb04c0e5124> Message-ID-Hash: VXLJA4D5TYMT5LRLIROS2ZFMDCVF6U52 X-Message-ID-Hash: VXLJA4D5TYMT5LRLIROS2ZFMDCVF6U52 X-MailFrom: code@ffmpeg.org X-Mailman-Rule-Hits: nonmember-moderation X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-ffmpeg-devel.ffmpeg.org-0; header-match-ffmpeg-devel.ffmpeg.org-1; header-match-ffmpeg-devel.ffmpeg.org-2; header-match-ffmpeg-devel.ffmpeg.org-3; emergency; member-moderation X-Mailman-Version: 3.3.10 Precedence: list Reply-To: FFmpeg development discussions and patches Subject: [FFmpeg-devel] [PATCH] avformat/mov: fixed bug in mov_merge_tts_data (PR #21234) List-Id: FFmpeg development discussions and patches Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: From: anders-mjoll via ffmpeg-devel Cc: anders-mjoll Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Archived-At: List-Archive: List-Post: PR #21234 opened by anders-mjoll URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21234 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21234.patch After upgrading to FFmpeg 8.0 (from FFmpeg 5.1.2) we got some customers reporting that FFmpeg consumed all the memory of the machine and was eventually killed by the OS. I was able to track it down to the MOV demuxer not producing any audio packets and the filter graph just caching up all the video frames from the 70 GB MOV file. This in turn appears to be because the index is never built for the audio stream. The reason it doesn't get built is because it fails the following check in `mov_merge_tts_data`: ``` if (!sc->sample_count || sc->sample_count >= UINT_MAX / sizeof(*sc->tts_data)) return -1; ``` This happens because this MOV file contains PCM and in that case it appears that the `sc->sample_count` is equal to the actual number of PCM samples not the number of entries in the `stts` and `ctts` tables. This PR fixes this issue by first obtaining the actual number of entries required by the ctts and stts tables. Unfortunately the file that triggers this problem is 70 GB and also contains sensitive customer data so I cannot provide a sample to reproduce the problem. >>From 0c2d59273ba09c73a97fee64e86aa190367228b8 Mon Sep 17 00:00:00 2001 From: Anders Rein Date: Thu, 18 Dec 2025 18:59:17 +0100 Subject: [PATCH] avformat/mov: fixed bug in mov_merge_tts_data Calculate the actual required size for the tts_data array instead of assuming sc->sample_count reflect the number of entries in the stts/ctts tables. This assumption does not hold for certain MOV files with PCM audio. --- libavformat/mov.c | 32 +++++++++++++++++++++++++------- 1 file changed, 25 insertions(+), 7 deletions(-) diff --git a/libavformat/mov.c b/libavformat/mov.c index 009ddfec80..be86878486 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -4637,25 +4637,43 @@ static int mov_merge_tts_data(MOVContext *mov, AVStream *st, int flags) int ctts = sc->ctts_data && (flags & MOV_MERGE_CTTS); int stts = sc->stts_data && (flags & MOV_MERGE_STTS); int idx = 0; + unsigned int ctts_total_count = 0; + unsigned int stts_total_count = 0; + unsigned int tts_count = 0; if (!sc->ctts_data && !sc->stts_data) return 0; + + if (sc->ctts_data) { + for (unsigned int i = 0; i < sc->ctts_count; i++) { + ctts_total_count += sc->ctts_data[i].count; + } + } + + if (sc->stts_data) { + for (unsigned int i = 0; i < sc->stts_count; i++) { + stts_total_count += sc->stts_data[i].count; + } + } + + tts_count = FFMAX(ctts_total_count, stts_total_count); + // Expand time to sample entries such that we have a 1-1 mapping with samples - if (!sc->sample_count || sc->sample_count >= UINT_MAX / sizeof(*sc->tts_data)) + if (!tts_count || tts_count >= UINT_MAX / sizeof(*sc->tts_data)) return -1; if (ctts) { sc->tts_data = av_fast_realloc(NULL, &sc->tts_allocated_size, - sc->sample_count * sizeof(*sc->tts_data)); + tts_count * sizeof(*sc->tts_data)); if (!sc->tts_data) return -1; memset(sc->tts_data, 0, sc->tts_allocated_size); for (int i = 0; i < sc->ctts_count && - idx < sc->sample_count; i++) + idx < tts_count; i++) for (int j = 0; j < sc->ctts_data[i].count && - idx < sc->sample_count; j++) { + idx < tts_count; j++) { sc->tts_data[idx].offset = sc->ctts_data[i].offset; sc->tts_data[idx++].count = 1; } @@ -4669,7 +4687,7 @@ static int mov_merge_tts_data(MOVContext *mov, AVStream *st, int flags) idx = 0; if (stts) { MOVTimeToSample *tts_data = av_fast_realloc(sc->tts_data, &sc->tts_allocated_size, - sc->sample_count * sizeof(*sc->tts_data)); + tts_count * sizeof(*sc->tts_data)); if (!tts_data) return -1; @@ -4678,9 +4696,9 @@ static int mov_merge_tts_data(MOVContext *mov, AVStream *st, int flags) sc->tts_data = tts_data; for (int i = 0; i < sc->stts_count && - idx < sc->sample_count; i++) + idx < tts_count; i++) for (int j = 0; j < sc->stts_data[i].count && - idx < sc->sample_count; j++) { + idx < tts_count; j++) { sc->tts_data[idx].duration = sc->stts_data[i].duration; sc->tts_data[idx++].count = 1; } -- 2.49.1 _______________________________________________ ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org