From patchwork Sun Oct 30 19:11:32 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andreas Cadhalpun X-Patchwork-Id: 1234 Delivered-To: ffmpegpatchwork@gmail.com Received: by 10.103.90.1 with SMTP id o1csp49063vsb; Sun, 30 Oct 2016 12:11:43 -0700 (PDT) X-Received: by 10.28.156.10 with SMTP id f10mr8153624wme.57.1477854703565; Sun, 30 Oct 2016 12:11:43 -0700 (PDT) Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org. [79.124.17.100]) by mx.google.com with ESMTP id 15si8262643wmk.49.2016.10.30.12.11.42; Sun, 30 Oct 2016 12:11:43 -0700 (PDT) Received-SPF: pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) client-ip=79.124.17.100; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@googlemail.com; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org; dmarc=fail (p=QUARANTINE dis=NONE) header.from=googlemail.com Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 60D7068925E; Sun, 30 Oct 2016 21:11:37 +0200 (EET) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from mail-wm0-f66.google.com (mail-wm0-f66.google.com [74.125.82.66]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id AD46B689212 for ; Sun, 30 Oct 2016 21:11:31 +0200 (EET) Received: by mail-wm0-f66.google.com with SMTP id c17so15517099wmc.3 for ; Sun, 30 Oct 2016 12:11:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=20120113; h=from:to:subject:message-id:date:user-agent:mime-version :content-transfer-encoding; bh=eEayS3y2pckyYJtkyR8Hi+QbMQEHwDtCOzPz1Zkyb5Y=; b=RlDNMO2BSCHOJ+U/HiRE9FM7ciatBWssw5tCce3QwE1vkBUxU+6h0AsTmX0XOJOFbT sgwCzOo4YxrZaFJa64sKGpbK8uWyaHT+zlCyO9S4GrHZyw8vYlaaYRmOxuv3iaPFMwhJ v6M/jfY2fQCUFwc8HLHNViJYhMEo5Ve5K6gkidRifNu7jUCt+onnjWuHWD+7YSHKN4Mz UJMZw3h1ebQXd0GYx/yNq9iiK/+JtpH0k5QDIFXlIufSeEAuOdM+IG7BjBKeD+uOPGsS 3EQoau0q39KqHgFElwX1p6o11g5/yHtTnH3Y2aXsWB5H2cHx3/3yerNVeRwsgrVN8NU1 jsXA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:subject:message-id:date:user-agent :mime-version:content-transfer-encoding; bh=eEayS3y2pckyYJtkyR8Hi+QbMQEHwDtCOzPz1Zkyb5Y=; b=j3nGOH1a6F3UcIcsRKADvUK4v9Dg5QFFXftY0P63HB3JaIDTiBTTW1uhxNbqAw9KWN gLmKBLrIqtpR8oocT0WmBPgsAIz/uXlisbYMF/71fcBOT2w4daJans4zzPQgd00UkLdL Wh6BhlimFsW+RbYAFWu6SwvJli8O98GOihLCTSQnNeoZsmtH5NspAfdymoX3iarTHTY4 QKHHN/wZ98rTVH6I5w2RYgO2t7KMQdJwb/bRLe5HXQAWlie33ra9Q2zyg2R5z+Ga5jdm 7bebh7DdKpa/ni/3C+f+G27ca+lUS+JFlvgY5pUVWz0TesU6cG+7NQo4JMEoalv/q6LM FU0w== X-Gm-Message-State: ABUngvdQNd9F7UOA4nLNPVI4VIUX6cGYoge+QB6KZlW6xruT8BPjz4C8xE0bOeH7yQMhnw== X-Received: by 10.28.210.195 with SMTP id j186mr8494811wmg.30.1477854694403; Sun, 30 Oct 2016 12:11:34 -0700 (PDT) Received: from [192.168.2.21] (pD9E8F048.dip0.t-ipconnect.de. [217.232.240.72]) by smtp.googlemail.com with ESMTPSA id a1sm25967093wju.41.2016.10.30.12.11.33 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sun, 30 Oct 2016 12:11:33 -0700 (PDT) From: Andreas Cadhalpun X-Google-Original-From: Andreas Cadhalpun To: FFmpeg development discussions and patches Message-ID: <41ecbe4f-8f70-809f-7d75-1012277f0b97@googlemail.com> Date: Sun, 30 Oct 2016 20:11:32 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Icedove/45.4.0 MIME-Version: 1.0 Subject: [FFmpeg-devel] [PATCH] mov: only read e_old if there were any old streams X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" This fixes a heap buffer overflow. Signed-off-by: Andreas Cadhalpun --- libavformat/mov.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/mov.c b/libavformat/mov.c index 357d800..95b546e 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -3028,7 +3028,7 @@ static void mov_fix_index(MOVContext *mov, AVStream *st) // Audio decoders like AAC need need a decoder delay samples previous to the current sample, // to correctly decode this frame. Hence for audio we seek to a frame 1 sec. before the // edit_list_media_time to cover the decoder delay. - search_timestamp = FFMAX(search_timestamp - mov->time_scale, e_old[0].timestamp); + search_timestamp = FFMAX(search_timestamp - mov->time_scale, nb_old ? e_old[0].timestamp : INT64_MIN); } index = find_prev_closest_keyframe_index(st, e_old, nb_old, search_timestamp, 0);