| Message ID | 20220111134038.42085-1-yshaw1999@163.com |
|---|---|
| State | Withdrawn |
| Headers | show |
| Series | [FFmpeg-devel] avformat/asfdec_f: init avpacket by av_packet_alloc() | expand |
| Context | Check | Description |
|---|---|---|
| andriy/commit_msg_x86 | warning | Please wrap lines in the body of the commit message between 60 and 72 characters. |
| andriy/make_x86 | success | Make finished |
| andriy/make_fate_x86 | success | Make fate finished |
| andriy/makex86 | warning | New warnings during build |
| andriy/commit_msg_ppc | warning | Please wrap lines in the body of the commit message between 60 and 72 characters. |
| andriy/make_ppc | success | Make finished |
| andriy/make_fate_ppc | success | Make fate finished |
| andriy/makeppc | warning | New warnings during build |
yshaw1999@163.com: > From: Yang Xiao <yshaw99@outlook.com> > > Pointer member side_data of AVPacket that allocated by stack may be wild pointer. > Prevent releasing wild pointers in AVPacket when some functions try to call av_packet_unref() > --- > libavformat/asfdec_f.c | 10 ++++++++-- > 1 file changed, 8 insertions(+), 2 deletions(-) > > diff --git a/libavformat/asfdec_f.c b/libavformat/asfdec_f.c > index a8f36ed286..605d9f53a1 100644 > --- a/libavformat/asfdec_f.c > +++ b/libavformat/asfdec_f.c > @@ -1433,7 +1433,9 @@ static int64_t asf_read_pts(AVFormatContext *s, int stream_index, > { > FFFormatContext *const si = ffformatcontext(s); > ASFContext *asf = s->priv_data; > - AVPacket pkt1, *pkt = &pkt1; > + AVPacket *pkt = av_packet_alloc(); > + if(!pkt) > + return AVERROR(ENOMEM); > ASFStream *asf_st; > int64_t pts; > int64_t pos = *ppos; > @@ -1448,13 +1450,16 @@ static int64_t asf_read_pts(AVFormatContext *s, int stream_index, > s->packet_size * s->packet_size + > si->data_offset; > *ppos = pos; > - if (avio_seek(s->pb, pos, SEEK_SET) < 0) > + if (avio_seek(s->pb, pos, SEEK_SET) < 0) { > + av_packet_free(&pkt); > return AV_NOPTS_VALUE; > + } > > ff_read_frame_flush(s); > asf_reset_header(s); > for (;;) { > if (av_read_frame(s, pkt) < 0) { > + av_packet_free(&pkt); > av_log(s, AV_LOG_INFO, "asf_read_pts failed\n"); > return AV_NOPTS_VALUE; > } > @@ -1483,6 +1488,7 @@ static int64_t asf_read_pts(AVFormatContext *s, int stream_index, > } > > *ppos = pos; > + av_packet_free(&pkt); > return pts; > } > > To repeat myself: Do you have FF_API_INIT_PACKET set to 0 (it should still be set to 1)? Because av_read_frame() is supposed to (and documented to) treat the packet it is given as uninitialized. - Andreas
diff --git a/libavformat/asfdec_f.c b/libavformat/asfdec_f.c index a8f36ed286..605d9f53a1 100644 --- a/libavformat/asfdec_f.c +++ b/libavformat/asfdec_f.c @@ -1433,7 +1433,9 @@ static int64_t asf_read_pts(AVFormatContext *s, int stream_index, { FFFormatContext *const si = ffformatcontext(s); ASFContext *asf = s->priv_data; - AVPacket pkt1, *pkt = &pkt1; + AVPacket *pkt = av_packet_alloc(); + if(!pkt) + return AVERROR(ENOMEM); ASFStream *asf_st; int64_t pts; int64_t pos = *ppos; @@ -1448,13 +1450,16 @@ static int64_t asf_read_pts(AVFormatContext *s, int stream_index, s->packet_size * s->packet_size + si->data_offset; *ppos = pos; - if (avio_seek(s->pb, pos, SEEK_SET) < 0) + if (avio_seek(s->pb, pos, SEEK_SET) < 0) { + av_packet_free(&pkt); return AV_NOPTS_VALUE; + } ff_read_frame_flush(s); asf_reset_header(s); for (;;) { if (av_read_frame(s, pkt) < 0) { + av_packet_free(&pkt); av_log(s, AV_LOG_INFO, "asf_read_pts failed\n"); return AV_NOPTS_VALUE; } @@ -1483,6 +1488,7 @@ static int64_t asf_read_pts(AVFormatContext *s, int stream_index, } *ppos = pos; + av_packet_free(&pkt); return pts; }
From: Yang Xiao <yshaw99@outlook.com> Pointer member side_data of AVPacket that allocated by stack may be wild pointer. Prevent releasing wild pointers in AVPacket when some functions try to call av_packet_unref() --- libavformat/asfdec_f.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)