| Message ID | CALvomiPObKwoRqNRXz-35AMV0CV5eZTmZrrYOA+sVR=5ycV9ow@mail.gmail.com |
|---|---|
| State | Superseded |
| Headers | show |
On Fri, May 12, 2017 at 06:31:19PM +0000, Rob Meyers wrote: > Submitting a patch to fix a bug in ffmpeg found when reading data from a > named pipe. In our test, a pipe sending twelve bytes in two 6 byte messages > results in the first 10 bytes being lost. We found the problem was > introduced with this commit (2ca48e466675a8a3630061cd2c15325eab8eda97) on > June 30, 2013. In this code, the "dst" pointer is always set to s->buffer, > and earlier message bytes are overwritten by later ones when assembling a > packet from multiple small reads. > > > diff --git a/libavformat/aviobuf.c b/libavformat/aviobuf.c > index 0a7c39eacd..4e04cb79e0 100644 > --- a/libavformat/aviobuf.c > +++ b/libavformat/aviobuf.c > @@ -519,9 +519,7 @@ void avio_write_marker(AVIOContext *s, int64_t time, > enum AVIODataMarkerType typ > > static void fill_buffer(AVIOContext *s) > { > - int max_buffer_size = s->max_packet_size ? > - s->max_packet_size : IO_BUFFER_SIZE; > - uint8_t *dst = s->buf_end - s->buffer + max_buffer_size < > s->buffer_size ? > + uint8_t *dst = !s->max_packet_size && s->buf_end - s->buffer < > s->buffer_size ? Patch is corrupted by linebreaks [...]
diff --git a/libavformat/aviobuf.c b/libavformat/aviobuf.c index 0a7c39eacd..4e04cb79e0 100644 --- a/libavformat/aviobuf.c +++ b/libavformat/aviobuf.c @@ -519,9 +519,7 @@ void avio_write_marker(AVIOContext *s, int64_t time, enum AVIODataMarkerType typ static void fill_buffer(AVIOContext *s) { - int max_buffer_size = s->max_packet_size ? - s->max_packet_size : IO_BUFFER_SIZE; - uint8_t *dst = s->buf_end - s->buffer + max_buffer_size < s->buffer_size ? + uint8_t *dst = !s->max_packet_size && s->buf_end - s->buffer < s->buffer_size ?
Submitting a patch to fix a bug in ffmpeg found when reading data from a named pipe. In our test, a pipe sending twelve bytes in two 6 byte messages results in the first 10 bytes being lost. We found the problem was introduced with this commit (2ca48e466675a8a3630061cd2c15325eab8eda97) on June 30, 2013. In this code, the "dst" pointer is always set to s->buffer, and earlier message bytes are overwritten by later ones when assembling a packet from multiple small reads. s->buf_end : s->buffer; int len = s->buffer_size - (dst - s->buffer);