[Ffmpeg-devel] [PATCH] fix segment fault in h264_parse if buf_size is zero

[Limin Wang]

Hi,

> > > > Index: libavcodec/h264.c
> > > > ===================================================================
> > > > --- libavcodec/h264.c	(revision 8688)
> > > > +++ libavcodec/h264.c	(working copy)
> > > > @@ -8059,7 +8059,7 @@
> > > >              return buf_size;
> > > >          }
> > > >  
> > > > -        if(next<0){
> > > > +        if(next<0 && pc->last_index+next > 0){
> > > 
> > > i think the check should rather be next<0 && next != END_NOT_FOUND
> > 
> > It's OK for the file end case, however anybody can make sure in these
> > condition, pc->last_index + next>=0? The logic isn't clear and difficult
> > to maintain.
> 
> if pc->last_index+next < 0 and next != END_NOT_FOUND then theres a bug
> somewhere and that has to be fixed not hidden, feel free to add assert()
> if you like

OK, update patch attached. One question is now the assert will do nothing
for NDEBUG is defined.

Thanks,
Limin
-------------- next part --------------
Index: libavcodec/h264.c
===================================================================
--- libavcodec/h264.c	(revision 8688)
+++ libavcodec/h264.c	(working copy)
@@ -8059,7 +8059,8 @@
             return buf_size;
         }
 
-        if(next<0){
+        if(next<0 && next != END_NOT_FOUND){
+            assert(pc->last_index + next >= 0 );
             find_frame_end(h, &pc->buffer[pc->last_index + next], -next); //update state
         }
     }