mov_chan: Pass a separate AVIOContext for reading

This fixes crashes when called from rtpdec_qt, where
AVFormatContext->pb is null, a crash present since 3bab7cd128.

Signed-off-by: Martin Storsjö <martin@martin.st>

libavformat/cafdec.c

@@ -268,7 +268,7 @@ static int read_header(AVFormatContext *s)
             break;
 
         case MKBETAG('c','h','a','n'):
-            if ((ret = ff_mov_read_chan(s, st, size)) < 0)
+            if ((ret = ff_mov_read_chan(s, s->pb, st, size)) < 0)
                 return ret;
             break;
 

libavformat/mov.c

@@ -583,7 +583,7 @@ static int mov_read_chan(MOVContext *c, AVIOContext *pb, MOVAtom atom)
     if (atom.size < 16)
         return 0;
 
-    ff_mov_read_chan(c->fc, st, atom.size - 4);
+    ff_mov_read_chan(c->fc, pb, st, atom.size - 4);
 
     return 0;
 }

libavformat/mov_chan.c

@@ -543,9 +543,9 @@ uint32_t ff_mov_get_channel_layout_tag(enum AVCodecID codec_id,
     return tag;
 }
 
-int ff_mov_read_chan(AVFormatContext *s, AVStream *st, int64_t size)
+int ff_mov_read_chan(AVFormatContext *s, AVIOContext *pb, AVStream *st,
+                     int64_t size)
 {
-    AVIOContext *pb = s->pb;
     uint32_t layout_tag, bitmap, num_descr, label_mask;
     int i;
 

libavformat/mov_chan.h

@@ -57,10 +57,12 @@ uint32_t ff_mov_get_channel_layout_tag(enum AVCodecID codec_id,
  * Read 'chan' tag from the input stream.
  *
  * @param s     AVFormatContext
+ * @param pb    AVIOContext
  * @param st    The stream to set codec values for
  * @param size  Remaining size in the 'chan' tag
  * @return      0 if ok, or negative AVERROR code on failure
  */
-int ff_mov_read_chan(AVFormatContext *s, AVStream *st, int64_t size);
+int ff_mov_read_chan(AVFormatContext *s, AVIOContext *pb, AVStream *st,
+                     int64_t size);
 
 #endif /* AVFORMAT_MOV_CHAN_H */