RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

lavf/mxfdec: Set a scan direction explicitly 

This prevents a theoretical case where seeks to a gap in an index can cause an infinite loop
This commit is contained in:
Tomas Härdin 2024-10-14 16:45:35 +02:00
parent b611410569
commit baa23e40c1
1 changed files with 10 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
libavformat/mxfdec.c
View File

@ -1907,7 +1907,7 @@ static int64_t mxf_essence_container_end(MXFContext *mxf, int body_sid)
/* EditUnit -> absolute offset */
static int mxf_edit_unit_absolute_offset(MXFContext *mxf, MXFIndexTable *index_table, int64_t edit_unit, AVRational edit_rate, int64_t *edit_unit_out, int64_t *offset_out, MXFPartition **partition_out, int nag)
{
int i = 0;
int i = 0, dir = 0;
int64_t index_duration, index_end;
MXFIndexTableSegment *first_segment, *last_segment;
@ -1939,7 +1939,7 @@ static int mxf_edit_unit_absolute_offset(MXFContext *mxf, MXFIndexTable *index_t
i = FFMAX(0, FFMIN(index_table->nb_segments - 1, i64));
}
for (; i >= 0 && i < index_table->nb_segments;) {
for (; i >= 0 && i < index_table->nb_segments; i += dir) {
MXFIndexTableSegment *s = index_table->segments[i];
if (s->index_start_position <= edit_unit && edit_unit < s->index_start_position + s->index_duration) {
@ -1969,12 +1969,14 @@ static int mxf_edit_unit_absolute_offset(MXFContext *mxf, MXFIndexTable *index_t
*edit_unit_out = av_rescale_q(edit_unit, edit_rate, s->index_edit_rate);
return mxf_absolute_bodysid_offset(mxf, index_table->body_sid, offset_temp, offset_out, partition_out);
} else if (edit_unit < s->index_start_position) {
// the segments are sorted by IndexStartPosition, so this is guaranteed to terminate
i--;
} else if (dir == 0) {
// scan backwards if the segment is earlier than the current IndexStartPosition
// else scan forwards
if (edit_unit < s->index_start_position) {
dir = -1;
} else {
// edit_unit >= s->index_start_position + s->index_duration
i++;
dir = 1;
}
}
}