[FFmpeg-devel] [PATCH] fix crash in realmedia demuxer

[Ronald S. Bultje]

Hi Jai,

On Fri, Dec 26, 2008 at 1:38 AM, Jai Menon <jmenon86 at gmail.com> wrote:
> First off, very sorry for the late reply, because of the holiday season :-)

Don't worry, same here.

> Well, the patch doesn't really allow playback and that was expected.
> It was just a temporary fix for the crash.
> I'm sure something could be hacked up, but that won't really solve anything.
> So until we understand how to work with samples with zero
> sub_packet_size, why not add the same sanity check
> for ac3 streams. Attached patch demonstrates this.
[..]
> @@ -194,6 +189,12 @@
>              st->codec->codec_id = CODEC_ID_NONE;
>              av_strlcpy(st->codec->codec_name, buf, sizeof(st->codec->codec_name));
>          }
> +
> +        if(sub_packet_size <= 0){
> +                av_log(s, AV_LOG_ERROR, "sub_packet_size is invalid\n");
> +                return -1;
> +        }
> +
>          if (read_all) {
>              get_byte(pb);
>              get_byte(pb);

This checks it for all audio streams, I'd place it just for those that
use sub_packet_size (AAC/AC3 doesn't, for example). That might crash
CVS head because it only allows for one audio stream.

>From your earlier mail, you said that this happens for AC3 streams
containing COOK packets, so I assume this means that you found streams
with multiple audios in it? Could you upload that somewhere? I'd like
to test my RMStream-patches with it, they should fix that issue as
well, and would be the correct fix, IMO.

Ronald