RepoMirrors/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2024-12-26 01:02:33 +00:00
Code Issues Projects Releases Wiki Activity

avformat/mov: Initialize a potential gap in ctts_data in mov_build_index

Browse Source 
mov_read_ctts ignores ctts entries having count <= 0. Generally, the
aggregate of all ctts entries' count fields resulting from mov_read_ctts
can be less than the corresponding sample_count.

mov_build_index attempts to normalize any existing ctts_data counts to
be 1, to make a 1-1 mapping of a ctts_data entry to a sample.

That 1-1 mapping left a tail of uninitialized ctts_data entries when the
aggregate, normalized ctts_count < sample_count.

Even more generally, later usage of ctts_data may depend on the entire
ctts_allocated_size having been initialized.

This change memsets the entire allocation of the normalized ctts_data in
mov_build_index, to prevent use of uninitialized data later.

BUG=816787

Change-Id: I7fd7db255e3aeed076ee32c90cb2df211741c052
Reviewed-on: https://chromium-review.googlesource.com/947110
Reviewed-by: Xiaohan Wang <xhwang@chromium.org>

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Matt Wolenetz 2018-03-02 15:12:41 -08:00 committed by Michael Niedermayer
parent 0ec7eb9305
commit 133ddd3875
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
libavformat/mov.c
View File

@ -3747,6 +3747,9 @@ static void mov_build_index(MOVContext *mov, AVStream *st)
av_free(ctts_data_old);
return;
}
memset((uint8_t*)(sc->ctts_data), 0, sc->ctts_allocated_size);
for (i = 0; i < ctts_count_old &&
sc->ctts_count < sc->sample_count; i++)
for (j = 0; j < ctts_data_old[i].count &&