diff mbox

[FFmpeg-devel] avformat/rmdec.c: fix left shift of negative value in rm_sync()

Message ID 20190915032239.1916-1-jamrial@gmail.com
State Superseded
Headers show

Commit Message

James Almer Sept. 15, 2019, 3:22 a.m. UTC 
Fixes ticket 8143.

Signed-off-by: James Almer <jamrial@gmail.com>
---
 libavformat/rmdec.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

Comments

Andreas Rheinhardt Sept. 15, 2019, 6:15 a.m. UTC | #1 
James Almer:
> Fixes ticket 8143.
> 
> Signed-off-by: James Almer <jamrial@gmail.com>
> ---
>  libavformat/rmdec.c | 3 +--
>  1 file changed, 1 insertion(+), 2 deletions(-)
> 
> diff --git a/libavformat/rmdec.c b/libavformat/rmdec.c
> index c9abd38d33..ccdc38f98a 100644
> --- a/libavformat/rmdec.c
> +++ b/libavformat/rmdec.c
> @@ -724,8 +724,7 @@ static int rm_sync(AVFormatContext *s, int64_t *timestamp, int *flags, int *stre
>  
>              num = avio_rb16(pb);
>              *timestamp = avio_rb32(pb);
> -            mlti_id = (avio_r8(pb)>>1)-1<<16;
> -            mlti_id = FFMAX(mlti_id, 0);
> +            mlti_id = FFMAX((avio_r8(pb) >> 1) - 1, 0) << 16;
>              *flags = avio_r8(pb); /* flags */
>          }
>          for(i=0;i<s->nb_streams;i++) {
> 
This will evaluate avio_r8(pb) twice when it is >= 4. I doubt that's
intended.

- Andreas
Michael Niedermayer Sept. 15, 2019, 8:14 a.m. UTC | #2 
On Sun, Sep 15, 2019 at 12:22:39AM -0300, James Almer wrote:
> Fixes ticket 8143.
> 
> Signed-off-by: James Almer <jamrial@gmail.com>
> ---
>  libavformat/rmdec.c | 3 +--
>  1 file changed, 1 insertion(+), 2 deletions(-)
> 
> diff --git a/libavformat/rmdec.c b/libavformat/rmdec.c
> index c9abd38d33..ccdc38f98a 100644
> --- a/libavformat/rmdec.c
> +++ b/libavformat/rmdec.c
> @@ -724,8 +724,7 @@ static int rm_sync(AVFormatContext *s, int64_t *timestamp, int *flags, int *stre
>  
>              num = avio_rb16(pb);
>              *timestamp = avio_rb32(pb);
> -            mlti_id = (avio_r8(pb)>>1)-1<<16;
> -            mlti_id = FFMAX(mlti_id, 0);
> +            mlti_id = FFMAX((avio_r8(pb) >> 1) - 1, 0) << 16;

functions with sideeffects like moving some file pointer should
not be used in macros which may evaluate their arguments multiple
times

thx

[...]
diff mbox

Patch

diff --git a/libavformat/rmdec.c b/libavformat/rmdec.c
index c9abd38d33..ccdc38f98a 100644
--- a/libavformat/rmdec.c
+++ b/libavformat/rmdec.c
@@ -724,8 +724,7 @@  static int rm_sync(AVFormatContext *s, int64_t *timestamp, int *flags, int *stre
 
             num = avio_rb16(pb);
             *timestamp = avio_rb32(pb);
-            mlti_id = (avio_r8(pb)>>1)-1<<16;
-            mlti_id = FFMAX(mlti_id, 0);
+            mlti_id = FFMAX((avio_r8(pb) >> 1) - 1, 0) << 16;
             *flags = avio_r8(pb); /* flags */
         }
         for(i=0;i<s->nb_streams;i++) {