Browse Source

avformat/mlvdec: Check for existence of AVIOContext before using it

The mlv demuxer supports input split into multiple files; if invalid
data is encountered when parsing one of the subsequent files, that file
is closed. But at this point some index entries belonging to this file
might already have been added. In this case, the read_packet function
might try to use the AVIOContext (which is NULL) to read data which will
of course crash. This commit fixes this.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
tags/n4.4
Andreas Rheinhardt 5 years ago
parent
commit
6e0dd41fa3
1 changed files with 7 additions and 1 deletions
  1. +7
    -1
      libavformat/mlvdec.c

+ 7
- 1
libavformat/mlvdec.c View File

@@ -411,6 +411,10 @@ static int read_packet(AVFormatContext *avctx, AVPacket *pkt)
} }


pb = mlv->pb[st->index_entries[index].size]; pb = mlv->pb[st->index_entries[index].size];
if (!pb) {
ret = FFERROR_REDO;
goto next_packet;
}
avio_seek(pb, st->index_entries[index].pos, SEEK_SET); avio_seek(pb, st->index_entries[index].pos, SEEK_SET);


avio_skip(pb, 4); // blockType avio_skip(pb, 4); // blockType
@@ -439,12 +443,14 @@ static int read_packet(AVFormatContext *avctx, AVPacket *pkt)
pkt->stream_index = mlv->stream_index; pkt->stream_index = mlv->stream_index;
pkt->pts = mlv->pts; pkt->pts = mlv->pts;


ret = 0;
next_packet:
mlv->stream_index++; mlv->stream_index++;
if (mlv->stream_index == avctx->nb_streams) { if (mlv->stream_index == avctx->nb_streams) {
mlv->stream_index = 0; mlv->stream_index = 0;
mlv->pts++; mlv->pts++;
} }
return 0;
return ret;
} }


static int read_seek(AVFormatContext *avctx, int stream_index, int64_t timestamp, int flags) static int read_seek(AVFormatContext *avctx, int stream_index, int64_t timestamp, int flags)


Loading…
Cancel
Save