[FFmpeg-devel] [PATCH] avformat/asfdec_f: init avpacket by av_packet_alloc()

[FFmpeg-devel] [PATCH] avformat/asfdec_f: init avpacket by av_packet_alloc()

[yshaw1999]

From: Yang Xiao <yshaw99@outlook.com>

Pointer member side_data of AVPacket that allocated by stack may be wild pointer.
Prevent releasing wild pointers in AVPacket when some functions try to call av_packet_unref()
---
 libavformat/asfdec_f.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/libavformat/asfdec_f.c b/libavformat/asfdec_f.c
index a8f36ed286..605d9f53a1 100644
--- a/libavformat/asfdec_f.c
+++ b/libavformat/asfdec_f.c
@@ -1433,7 +1433,9 @@ static int64_t asf_read_pts(AVFormatContext *s, int stream_index,
 {
     FFFormatContext *const si = ffformatcontext(s);
     ASFContext *asf     = s->priv_data;
-    AVPacket pkt1, *pkt = &pkt1;
+    AVPacket *pkt = av_packet_alloc();
+    if(!pkt)
+        return AVERROR(ENOMEM);
     ASFStream *asf_st;
     int64_t pts;
     int64_t pos = *ppos;
@@ -1448,13 +1450,16 @@ static int64_t asf_read_pts(AVFormatContext *s, int stream_index,
               s->packet_size * s->packet_size +
               si->data_offset;
     *ppos = pos;
-    if (avio_seek(s->pb, pos, SEEK_SET) < 0)
+    if (avio_seek(s->pb, pos, SEEK_SET) < 0) {
+        av_packet_free(&pkt);
         return AV_NOPTS_VALUE;
+    }
 
     ff_read_frame_flush(s);
     asf_reset_header(s);
     for (;;) {
         if (av_read_frame(s, pkt) < 0) {
+            av_packet_free(&pkt);
             av_log(s, AV_LOG_INFO, "asf_read_pts failed\n");
             return AV_NOPTS_VALUE;
         }
@@ -1483,6 +1488,7 @@ static int64_t asf_read_pts(AVFormatContext *s, int stream_index,
     }
 
     *ppos = pos;
+    av_packet_free(&pkt);
     return pts;
 }
 
-- 
2.30.1 (Apple Git-130)

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH] avformat/asfdec_f: init avpacket by av_packet_alloc()

[Andreas Rheinhardt]

yshaw1999@163.com:
> From: Yang Xiao <yshaw99@outlook.com>
> 
> Pointer member side_data of AVPacket that allocated by stack may be wild pointer.
> Prevent releasing wild pointers in AVPacket when some functions try to call av_packet_unref()
> ---
>  libavformat/asfdec_f.c | 10 ++++++++--
>  1 file changed, 8 insertions(+), 2 deletions(-)
> 
> diff --git a/libavformat/asfdec_f.c b/libavformat/asfdec_f.c
> index a8f36ed286..605d9f53a1 100644
> --- a/libavformat/asfdec_f.c
> +++ b/libavformat/asfdec_f.c
> @@ -1433,7 +1433,9 @@ static int64_t asf_read_pts(AVFormatContext *s, int stream_index,
>  {
>      FFFormatContext *const si = ffformatcontext(s);
>      ASFContext *asf     = s->priv_data;
> -    AVPacket pkt1, *pkt = &pkt1;
> +    AVPacket *pkt = av_packet_alloc();
> +    if(!pkt)
> +        return AVERROR(ENOMEM);
>      ASFStream *asf_st;
>      int64_t pts;
>      int64_t pos = *ppos;
> @@ -1448,13 +1450,16 @@ static int64_t asf_read_pts(AVFormatContext *s, int stream_index,
>                s->packet_size * s->packet_size +
>                si->data_offset;
>      *ppos = pos;
> -    if (avio_seek(s->pb, pos, SEEK_SET) < 0)
> +    if (avio_seek(s->pb, pos, SEEK_SET) < 0) {
> +        av_packet_free(&pkt);
>          return AV_NOPTS_VALUE;
> +    }
>  
>      ff_read_frame_flush(s);
>      asf_reset_header(s);
>      for (;;) {
>          if (av_read_frame(s, pkt) < 0) {
> +            av_packet_free(&pkt);
>              av_log(s, AV_LOG_INFO, "asf_read_pts failed\n");
>              return AV_NOPTS_VALUE;
>          }
> @@ -1483,6 +1488,7 @@ static int64_t asf_read_pts(AVFormatContext *s, int stream_index,
>      }
>  
>      *ppos = pos;
> +    av_packet_free(&pkt);
>      return pts;
>  }
>  
> 

To repeat myself: Do you have FF_API_INIT_PACKET set to 0 (it should
still be set to 1)? Because av_read_frame() is supposed to (and
documented to) treat the packet it is given as uninitialized.

- Andreas
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".