* [FFmpeg-devel] [PATCH] avformat/mxfenc: Ensure keyframe offset in valid range
@ 2025-07-16 3:57 Zhao Zhili
2025-07-21 17:24 ` Zhao Zhili
0 siblings, 1 reply; 2+ messages in thread
From: Zhao Zhili @ 2025-07-16 3:57 UTC (permalink / raw)
To: ffmpeg-devel; +Cc: Zhao Zhili
From: Zhao Zhili <zhilizhao@tencent.com>
Fix assert failure.
Fix #11666.
---
libavformat/mxfenc.c | 43 ++++++++++++++++++++++++++++++++++++-------
1 file changed, 36 insertions(+), 7 deletions(-)
diff --git a/libavformat/mxfenc.c b/libavformat/mxfenc.c
index d12ccfd739..fbfa49693b 100644
--- a/libavformat/mxfenc.c
+++ b/libavformat/mxfenc.c
@@ -1983,7 +1983,17 @@ static unsigned klv_fill_size(uint64_t size)
return pad & (KAG_SIZE-1);
}
-static void mxf_write_index_table_segment(AVFormatContext *s)
+static inline int mxf_check_keyframe_offset(AVFormatContext *s, int offset)
+{
+ if (offset >= INT8_MIN && offset <= INT8_MAX)
+ return 0;
+
+ av_log(s, AV_LOG_ERROR, "keyframe offset %d out of range [%d,%d], please reduce "
+ "encoder GOP size\n", offset, INT8_MIN, INT8_MAX);
+ return AVERROR_INVALIDDATA;
+}
+
+static int mxf_write_index_table_segment(AVFormatContext *s)
{
MXFContext *mxf = s->priv_data;
AVIOContext *pb = s->pb;
@@ -1992,11 +2002,12 @@ static void mxf_write_index_table_segment(AVFormatContext *s)
int prev_non_b_picture = 0;
int audio_frame_size = 0;
int64_t pos;
+ int err;
av_log(s, AV_LOG_DEBUG, "edit units count %d\n", mxf->edit_units_count);
if (!mxf->edit_units_count && !mxf->edit_unit_byte_count)
- return;
+ return 0;
avio_write(pb, index_table_segment_key, 16);
@@ -2100,9 +2111,17 @@ static void mxf_write_index_table_segment(AVFormatContext *s)
avio_w8(pb, temporal_offset);
if ((mxf->index_entries[i].flags & 0x30) == 0x30) { // back and forward prediction
+ int offset = mxf->last_key_index - i;
+ err = mxf_check_keyframe_offset(s, offset);
+ if (err < 0)
+ return err;
sc->b_picture_count = FFMAX(sc->b_picture_count, i - prev_non_b_picture);
- avio_w8(pb, mxf->last_key_index - i);
+ avio_w8(pb, offset);
} else {
+ int offset = key_index - i;
+ err = mxf_check_keyframe_offset(s, offset);
+ if (err < 0)
+ return err;
avio_w8(pb, key_index - i); // key frame offset
if ((mxf->index_entries[i].flags & 0x20) == 0x20) // only forward
mxf->last_key_index = key_index;
@@ -2127,6 +2146,8 @@ static void mxf_write_index_table_segment(AVFormatContext *s)
}
mxf_update_klv_size(pb, pos);
+
+ return 0;
}
static void mxf_write_klv_fill(AVFormatContext *s)
@@ -3354,7 +3375,9 @@ static int mxf_write_packet(AVFormatContext *s, AVPacket *pkt)
if ((err = mxf_write_partition(s, 1, 2, header_open_partition_key, 1)) < 0)
return err;
mxf_write_klv_fill(s);
- mxf_write_index_table_segment(s);
+ err = mxf_write_index_table_segment(s);
+ if (err < 0)
+ return err;
} else {
if ((err = mxf_write_partition(s, 0, 0, header_open_partition_key, 1)) < 0)
return err;
@@ -3370,7 +3393,9 @@ static int mxf_write_packet(AVFormatContext *s, AVPacket *pkt)
if ((err = mxf_write_partition(s, 1, 2, body_partition_key, 0)) < 0)
return err;
mxf_write_klv_fill(s);
- mxf_write_index_table_segment(s);
+ err = mxf_write_index_table_segment(s);
+ if (err < 0)
+ return err;
}
mxf_write_klv_fill(s);
@@ -3455,7 +3480,9 @@ static int mxf_write_footer(AVFormatContext *s)
if ((err = mxf_write_partition(s, 0, 2, footer_partition_key, 0)) < 0)
return err;
mxf_write_klv_fill(s);
- mxf_write_index_table_segment(s);
+ err = mxf_write_index_table_segment(s);
+ if (err < 0)
+ return err;
}
mxf_write_klv_fill(s);
@@ -3474,7 +3501,9 @@ static int mxf_write_footer(AVFormatContext *s)
if ((err = mxf_write_partition(s, 1, 2, header_closed_partition_key, 1)) < 0)
return err;
mxf_write_klv_fill(s);
- mxf_write_index_table_segment(s);
+ err = mxf_write_index_table_segment(s);
+ if (err < 0)
+ return err;
} else {
if ((err = mxf_write_partition(s, 0, 0, header_closed_partition_key, 1)) < 0)
return err;
--
2.46.0
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [FFmpeg-devel] [PATCH] avformat/mxfenc: Ensure keyframe offset in valid range
2025-07-16 3:57 [FFmpeg-devel] [PATCH] avformat/mxfenc: Ensure keyframe offset in valid range Zhao Zhili
@ 2025-07-21 17:24 ` Zhao Zhili
0 siblings, 0 replies; 2+ messages in thread
From: Zhao Zhili @ 2025-07-21 17:24 UTC (permalink / raw)
To: ffmpeg-devel; +Cc: Tomas Härdin
Ping.
> On Jul 16, 2025, at 11:57, Zhao Zhili <quinkblack@foxmail.com> wrote:
>
> From: Zhao Zhili <zhilizhao@tencent.com>
>
> Fix assert failure.
> Fix #11666.
> ---
> libavformat/mxfenc.c | 43 ++++++++++++++++++++++++++++++++++++-------
> 1 file changed, 36 insertions(+), 7 deletions(-)
>
> diff --git a/libavformat/mxfenc.c b/libavformat/mxfenc.c
> index d12ccfd739..fbfa49693b 100644
> --- a/libavformat/mxfenc.c
> +++ b/libavformat/mxfenc.c
> @@ -1983,7 +1983,17 @@ static unsigned klv_fill_size(uint64_t size)
> return pad & (KAG_SIZE-1);
> }
>
> -static void mxf_write_index_table_segment(AVFormatContext *s)
> +static inline int mxf_check_keyframe_offset(AVFormatContext *s, int offset)
> +{
> + if (offset >= INT8_MIN && offset <= INT8_MAX)
> + return 0;
> +
> + av_log(s, AV_LOG_ERROR, "keyframe offset %d out of range [%d,%d], please reduce "
> + "encoder GOP size\n", offset, INT8_MIN, INT8_MAX);
> + return AVERROR_INVALIDDATA;
> +}
> +
> +static int mxf_write_index_table_segment(AVFormatContext *s)
> {
> MXFContext *mxf = s->priv_data;
> AVIOContext *pb = s->pb;
> @@ -1992,11 +2002,12 @@ static void mxf_write_index_table_segment(AVFormatContext *s)
> int prev_non_b_picture = 0;
> int audio_frame_size = 0;
> int64_t pos;
> + int err;
>
> av_log(s, AV_LOG_DEBUG, "edit units count %d\n", mxf->edit_units_count);
>
> if (!mxf->edit_units_count && !mxf->edit_unit_byte_count)
> - return;
> + return 0;
>
> avio_write(pb, index_table_segment_key, 16);
>
> @@ -2100,9 +2111,17 @@ static void mxf_write_index_table_segment(AVFormatContext *s)
> avio_w8(pb, temporal_offset);
>
> if ((mxf->index_entries[i].flags & 0x30) == 0x30) { // back and forward prediction
> + int offset = mxf->last_key_index - i;
> + err = mxf_check_keyframe_offset(s, offset);
> + if (err < 0)
> + return err;
> sc->b_picture_count = FFMAX(sc->b_picture_count, i - prev_non_b_picture);
> - avio_w8(pb, mxf->last_key_index - i);
> + avio_w8(pb, offset);
> } else {
> + int offset = key_index - i;
> + err = mxf_check_keyframe_offset(s, offset);
> + if (err < 0)
> + return err;
> avio_w8(pb, key_index - i); // key frame offset
> if ((mxf->index_entries[i].flags & 0x20) == 0x20) // only forward
> mxf->last_key_index = key_index;
> @@ -2127,6 +2146,8 @@ static void mxf_write_index_table_segment(AVFormatContext *s)
> }
>
> mxf_update_klv_size(pb, pos);
> +
> + return 0;
> }
>
> static void mxf_write_klv_fill(AVFormatContext *s)
> @@ -3354,7 +3375,9 @@ static int mxf_write_packet(AVFormatContext *s, AVPacket *pkt)
> if ((err = mxf_write_partition(s, 1, 2, header_open_partition_key, 1)) < 0)
> return err;
> mxf_write_klv_fill(s);
> - mxf_write_index_table_segment(s);
> + err = mxf_write_index_table_segment(s);
> + if (err < 0)
> + return err;
> } else {
> if ((err = mxf_write_partition(s, 0, 0, header_open_partition_key, 1)) < 0)
> return err;
> @@ -3370,7 +3393,9 @@ static int mxf_write_packet(AVFormatContext *s, AVPacket *pkt)
> if ((err = mxf_write_partition(s, 1, 2, body_partition_key, 0)) < 0)
> return err;
> mxf_write_klv_fill(s);
> - mxf_write_index_table_segment(s);
> + err = mxf_write_index_table_segment(s);
> + if (err < 0)
> + return err;
> }
>
> mxf_write_klv_fill(s);
> @@ -3455,7 +3480,9 @@ static int mxf_write_footer(AVFormatContext *s)
> if ((err = mxf_write_partition(s, 0, 2, footer_partition_key, 0)) < 0)
> return err;
> mxf_write_klv_fill(s);
> - mxf_write_index_table_segment(s);
> + err = mxf_write_index_table_segment(s);
> + if (err < 0)
> + return err;
> }
>
> mxf_write_klv_fill(s);
> @@ -3474,7 +3501,9 @@ static int mxf_write_footer(AVFormatContext *s)
> if ((err = mxf_write_partition(s, 1, 2, header_closed_partition_key, 1)) < 0)
> return err;
> mxf_write_klv_fill(s);
> - mxf_write_index_table_segment(s);
> + err = mxf_write_index_table_segment(s);
> + if (err < 0)
> + return err;
> } else {
> if ((err = mxf_write_partition(s, 0, 0, header_closed_partition_key, 1)) < 0)
> return err;
> --
> 2.46.0
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2025-07-21 17:25 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2025-07-16 3:57 [FFmpeg-devel] [PATCH] avformat/mxfenc: Ensure keyframe offset in valid range Zhao Zhili
2025-07-21 17:24 ` Zhao Zhili
Git Inbox Mirror of the ffmpeg-devel mailing list - see https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
This inbox may be cloned and mirrored by anyone:
git clone --mirror https://master.gitmailbox.com/ffmpegdev/0 ffmpegdev/git/0.git
# If you have public-inbox 1.1+ installed, you may
# initialize and index your mirror using the following commands:
public-inbox-init -V2 ffmpegdev ffmpegdev/ https://master.gitmailbox.com/ffmpegdev \
ffmpegdev@gitmailbox.com
public-inbox-index ffmpegdev
Example config snippet for mirrors.
AGPL code for this site: git clone https://public-inbox.org/public-inbox.git