[FFmpeg-devel] [PATCH 1/2] avformat/mov: Don't zero twice

[FFmpeg-devel] [PATCH 1/2] avformat/mov: Don't zero twice

[Andreas Rheinhardt]

Redundant since eee3b7e2fb0664b889e58c03f76e19ef23e4d1d8.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
---
 libavformat/mov.c | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/libavformat/mov.c b/libavformat/mov.c
index effa46120f..d81e34d100 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -4287,10 +4287,6 @@ static void mov_fix_index(MOVContext *mov, AVStream *st)
     av_free(ctts_data_old);
     av_freep(&frame_duration_buffer);
 
-    // Null terminate the index ranges array
-    current_index_range++;
-    current_index_range->start = 0;
-    current_index_range->end = 0;
     msc->current_index = msc->index_ranges[0].start;
 }
 
-- 
2.40.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 2/2] avformat/mov: Don't use entry[-1] in pointer arithmetic

[Andreas Rheinhardt]

It is undefined behaviour.
Fixes many failed tests with UBSan and GCC 13 like
"src/libavformat/mov.c:4229:44: runtime error: store to address
0x5572abe20f80 with insufficient space for an object of type 'struct
MOVIndexRange'"
(The line number does not refer to the line where &entry[-1]
is assigned.)

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
---
Could also use index addressing; or a next_index_range pointer.

 libavformat/mov.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/libavformat/mov.c b/libavformat/mov.c
index d81e34d100..fac250363b 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -4022,7 +4022,7 @@ static void mov_fix_index(MOVContext *mov, AVStream *st)
     int num_discarded_begin = 0;
     int first_non_zero_audio_edit = -1;
     int packet_skip_samples = 0;
-    MOVIndexRange *current_index_range;
+    MOVIndexRange *current_index_range = NULL;
     int found_keyframe_after_edit = 0;
     int found_non_empty_edit = 0;
 
@@ -4037,7 +4037,6 @@ static void mov_fix_index(MOVContext *mov, AVStream *st)
         return;
     }
     msc->current_index_range = msc->index_ranges;
-    current_index_range = msc->index_ranges - 1;
 
     // Clean AVStream from traces of old index
     sti->index_entries = NULL;
@@ -4224,8 +4223,9 @@ static void mov_fix_index(MOVContext *mov, AVStream *st)
             }
 
             // Update the index ranges array
-            if (current_index_range < msc->index_ranges || index != current_index_range->end) {
-                current_index_range++;
+            if (!current_index_range || index != current_index_range->end) {
+                current_index_range = current_index_range ? current_index_range + 1
+                                                          : msc->index_ranges;
                 current_index_range->start = index;
             }
             current_index_range->end = index + 1;
-- 
2.40.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 1/2] avformat/mov: Don't zero twice

[James Almer]

On 2/26/2024 6:45 PM, Andreas Rheinhardt wrote:
> Redundant since eee3b7e2fb0664b889e58c03f76e19ef23e4d1d8.
> 
> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
> ---
>   libavformat/mov.c | 4 ----
>   1 file changed, 4 deletions(-)
> 
> diff --git a/libavformat/mov.c b/libavformat/mov.c
> index effa46120f..d81e34d100 100644
> --- a/libavformat/mov.c
> +++ b/libavformat/mov.c
> @@ -4287,10 +4287,6 @@ static void mov_fix_index(MOVContext *mov, AVStream *st)
>       av_free(ctts_data_old);
>       av_freep(&frame_duration_buffer);
>   
> -    // Null terminate the index ranges array
> -    current_index_range++;
> -    current_index_range->start = 0;
> -    current_index_range->end = 0;
>       msc->current_index = msc->index_ranges[0].start;
>   }

If zeroing the buffer proved to not be beneficial, then maybe it's best 
to revert said commit (or replace av_calloc with av_malloc_array to keep 
the integer overflow checks).
It will prevent writing to the same memory twice, and allow us to detect 
unintended access to uninitialized bytes.

Either way lgtm.
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".