RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

mxfdec: Fix infinite loop in mxf_packet_timestamps() 

This can happen if an index table segment has a very large IndexStartPosition.
zzuf3.mxf is an example of such a file.
This commit is contained in:
Tomas Härdin 2011-12-20 18:04:13 +01:00
parent 2116e4ba91
commit 4ae7d45170
1 changed files with 9 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
libavformat/mxfdec.c
View File

@ -1712,7 +1712,7 @@ static int mxf_read_header(AVFormatContext *s, AVFormatParameters *ap)
*/
static void mxf_packet_timestamps(MXFContext *mxf, AVPacket *pkt)
{
int64_t next_ofs;
int64_t last_ofs = -1, next_ofs;
MXFIndexTable *t = &mxf->index_tables[0];
/* this is called from the OP1a demuxing logic, which means there may be no index tables */
@ -1724,9 +1724,17 @@ static void mxf_packet_timestamps(MXFContext *mxf, AVPacket *pkt)
if (mxf_edit_unit_absolute_offset(mxf, t, mxf->current_edit_unit + 1, NULL, &next_ofs, 0) < 0)
break;
if (next_ofs <= last_ofs) {
/* large next_ofs didn't change or current_edit_unit wrapped around
* this fixes the infinite loop on zzuf3.mxf */
av_log(mxf->fc, AV_LOG_ERROR, "next_ofs didn't change. not deriving packet timestamps\n");
return;
}
if (next_ofs > pkt->pos)
break;
last_ofs = next_ofs;
mxf->current_edit_unit++;
}