* [FFmpeg-devel] [PATCH] avformat/asfdec: init avpacket by av_packet_alloc()
@ 2022-01-11 2:30 13102179620
2022-01-11 2:35 ` James Almer
0 siblings, 1 reply; 2+ messages in thread
From: 13102179620 @ 2022-01-11 2:30 UTC (permalink / raw)
To: ffmpeg-devel; +Cc: Yang Xiao
From: Yang Xiao <yshaw99@outlook.com>
This commit fixed a crash when seeking wma frames, asf decoder will try to demux in function asf_read_pts().
Pointer member side_data of AVPacket that allocated by stack may be wild pointer.
Prevent releasing wild pointers in AVPacket when some functions try to call av_packet_unref, example av_read_frame().
---
libavformat/asfdec_f.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavformat/asfdec_f.c b/libavformat/asfdec_f.c
index a8f36ed286..8cf953830e 100644
--- a/libavformat/asfdec_f.c
+++ b/libavformat/asfdec_f.c
@@ -1433,7 +1433,7 @@ static int64_t asf_read_pts(AVFormatContext *s, int stream_index,
{
FFFormatContext *const si = ffformatcontext(s);
ASFContext *asf = s->priv_data;
- AVPacket pkt1, *pkt = &pkt1;
+ AVPacket *pkt = av_packet_alloc();
ASFStream *asf_st;
int64_t pts;
int64_t pos = *ppos;
--
2.30.1 (Apple Git-130)
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [FFmpeg-devel] [PATCH] avformat/asfdec: init avpacket by av_packet_alloc()
2022-01-11 2:30 [FFmpeg-devel] [PATCH] avformat/asfdec: init avpacket by av_packet_alloc() 13102179620
@ 2022-01-11 2:35 ` James Almer
0 siblings, 0 replies; 2+ messages in thread
From: James Almer @ 2022-01-11 2:35 UTC (permalink / raw)
To: ffmpeg-devel
On 1/10/2022 11:30 PM, 13102179620@163.com wrote:
> From: Yang Xiao <yshaw99@outlook.com>
>
> This commit fixed a crash when seeking wma frames, asf decoder will try to demux in function asf_read_pts().
> Pointer member side_data of AVPacket that allocated by stack may be wild pointer.
> Prevent releasing wild pointers in AVPacket when some functions try to call av_packet_unref, example av_read_frame().
> ---
> libavformat/asfdec_f.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/libavformat/asfdec_f.c b/libavformat/asfdec_f.c
> index a8f36ed286..8cf953830e 100644
> --- a/libavformat/asfdec_f.c
> +++ b/libavformat/asfdec_f.c
> @@ -1433,7 +1433,7 @@ static int64_t asf_read_pts(AVFormatContext *s, int stream_index,
> {
> FFFormatContext *const si = ffformatcontext(s);
> ASFContext *asf = s->priv_data;
> - AVPacket pkt1, *pkt = &pkt1;
> + AVPacket *pkt = av_packet_alloc();
You're not checking pkt for allocation failure, and you're never freeing
it after using it, so it will leak.
> ASFStream *asf_st;
> int64_t pts;
> int64_t pos = *ppos;
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2022-01-11 2:35 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-01-11 2:30 [FFmpeg-devel] [PATCH] avformat/asfdec: init avpacket by av_packet_alloc() 13102179620
2022-01-11 2:35 ` James Almer
Git Inbox Mirror of the ffmpeg-devel mailing list - see https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
This inbox may be cloned and mirrored by anyone:
git clone --mirror https://master.gitmailbox.com/ffmpegdev/0 ffmpegdev/git/0.git
# If you have public-inbox 1.1+ installed, you may
# initialize and index your mirror using the following commands:
public-inbox-init -V2 ffmpegdev ffmpegdev/ https://master.gitmailbox.com/ffmpegdev \
ffmpegdev@gitmailbox.com
public-inbox-index ffmpegdev
Example config snippet for mirrors.
AGPL code for this site: git clone https://public-inbox.org/public-inbox.git