mirror of https://git.ffmpeg.org/ffmpeg.git
mxfdec: Fix infinite loop in mxf_packet_timestamps()
This can happen if an index table segment has a very large IndexStartPosition. zzuf3.mxf is an example of such a file. Signed-off-by: Diego Biurrun <diego@biurrun.de>
This commit is contained in:
parent
0373ec635d
commit
e352c96c17
|
@ -1761,7 +1761,7 @@ static int mxf_read_header(AVFormatContext *s)
|
||||||
*/
|
*/
|
||||||
static void mxf_packet_timestamps(MXFContext *mxf, AVPacket *pkt)
|
static void mxf_packet_timestamps(MXFContext *mxf, AVPacket *pkt)
|
||||||
{
|
{
|
||||||
int64_t next_ofs;
|
int64_t last_ofs = -1, next_ofs;
|
||||||
MXFIndexTable *t = &mxf->index_tables[0];
|
MXFIndexTable *t = &mxf->index_tables[0];
|
||||||
|
|
||||||
/* this is called from the OP1a demuxing logic, which means there
|
/* this is called from the OP1a demuxing logic, which means there
|
||||||
|
@ -1774,9 +1774,18 @@ static void mxf_packet_timestamps(MXFContext *mxf, AVPacket *pkt)
|
||||||
if (mxf_edit_unit_absolute_offset(mxf, t, mxf->current_edit_unit + 1, NULL, &next_ofs, 0) < 0)
|
if (mxf_edit_unit_absolute_offset(mxf, t, mxf->current_edit_unit + 1, NULL, &next_ofs, 0) < 0)
|
||||||
break;
|
break;
|
||||||
|
|
||||||
|
if (next_ofs <= last_ofs) {
|
||||||
|
/* large next_ofs didn't change or current_edit_unit wrapped
|
||||||
|
* around this fixes the infinite loop on zzuf3.mxf */
|
||||||
|
av_log(mxf->fc, AV_LOG_ERROR,
|
||||||
|
"next_ofs didn't change. not deriving packet timestamps\n");
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
|
||||||
if (next_ofs > pkt->pos)
|
if (next_ofs > pkt->pos)
|
||||||
break;
|
break;
|
||||||
|
|
||||||
|
last_ofs = next_ofs;
|
||||||
mxf->current_edit_unit++;
|
mxf->current_edit_unit++;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
Loading…
Reference in New Issue