[FFmpeg-devel] lavf/matroska: comment a missing error check.

Submitted by Nicolas George on Dec. 23, 2016, 8:39 p.m.

Details

Message ID 20161223203935.7970-1-george@nsup.org
State New
Headers show

Commit Message

Nicolas George Dec. 23, 2016, 8:39 p.m.
Signed-off-by: Nicolas George <george@nsup.org>
---
 libavformat/matroskaenc.c | 1 +
 1 file changed, 1 insertion(+)


I do not have time to fix this, but I got a few segfaults here, so it needs
to be fixed. Either push the patch or, better push an actual fix.

Comments

Michael Niedermayer Jan. 17, 2017, 2:59 a.m.
On Fri, Dec 23, 2016 at 09:39:35PM +0100, Nicolas George wrote:
> Signed-off-by: Nicolas George <george@nsup.org>
> ---
>  libavformat/matroskaenc.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> 
> I do not have time to fix this, but I got a few segfaults here, so it needs
> to be fixed. Either push the patch or, better push an actual fix.

instructions to reproduce the issue or a stack trace would make it
easier for interrested people to fix this

i can guess that maybe buf is NULL but thats just a guess

[...]
Nicolas George Jan. 18, 2017, 3:42 p.m.
L'octidi 28 nivôse, an CCXXV, Michael Niedermayer a écrit :
> instructions to reproduce the issue or a stack trace would make it
> easier for interrested people to fix this
> 
> i can guess that maybe buf is NULL but thats just a guess

Yes, it happens when flirting with OOM, when OOM happens in one of the
allocations for dyn_buf, the error is kept and reported when calling
avio_close_dyn_buf(), and in that case buf is NULL and causes a segfault
a few lines below.

Regards,

Patch hide | download patch | download mbox

diff --git a/libavformat/matroskaenc.c b/libavformat/matroskaenc.c
index 827d7550c2..8e536f6774 100644
--- a/libavformat/matroskaenc.c
+++ b/libavformat/matroskaenc.c
@@ -351,6 +351,7 @@  static void end_ebml_master_crc32(AVIOContext *pb, AVIOContext **dyn_cp, Matrosk
 
     if (pb->seekable) {
         size = avio_close_dyn_buf(*dyn_cp, &buf);
+        /* FIXME missing error check */
         if (mkv->write_crc && mkv->mode != MODE_WEBM) {
             skip = 6; /* Skip reserved 6-byte long void element from the dynamic buffer. */
             AV_WL32(crc, av_crc(av_crc_get_table(AV_CRC_32_IEEE_LE), UINT32_MAX, buf + skip, size - skip) ^ UINT32_MAX);