[FFmpeg-devel] [PATCH] fix crash in realmedia demuxer

[Jai Menon]

Hi,

On Fri, Dec 26, 2008 at 6:27 PM, Ronald S. Bultje <rsbultje at gmail.com> wrote:
> Hi Jai,
>
> On Fri, Dec 26, 2008 at 1:38 AM, Jai Menon <jmenon86 at gmail.com> wrote:
>> First off, very sorry for the late reply, because of the holiday season :-)
>
> Don't worry, same here.
>
>> Well, the patch doesn't really allow playback and that was expected.
>> It was just a temporary fix for the crash.
>> I'm sure something could be hacked up, but that won't really solve anything.
>> So until we understand how to work with samples with zero
>> sub_packet_size, why not add the same sanity check
>> for ac3 streams. Attached patch demonstrates this.
> [..]
>> @@ -194,6 +189,12 @@
>>              st->codec->codec_id = CODEC_ID_NONE;
>>              av_strlcpy(st->codec->codec_name, buf, sizeof(st->codec->codec_name));
>>          }
>> +
>> +        if(sub_packet_size <= 0){
>> +                av_log(s, AV_LOG_ERROR, "sub_packet_size is invalid\n");
>> +                return -1;
>> +        }
>> +
>>          if (read_all) {
>>              get_byte(pb);
>>              get_byte(pb);
>
> This checks it for all audio streams, I'd place it just for those that
> use sub_packet_size (AAC/AC3 doesn't, for example). That might crash
> CVS head because it only allows for one audio stream.
>
> From your earlier mail, you said that this happens for AC3 streams
> containing COOK packets, so I assume this means that you found streams
> with multiple audios in it? Could you upload that somewhere? I'd like
> to test my RMStream-patches with it, they should fix that issue as
> well, and would be the correct fix, IMO.

You could try this sample ->
http://talkischeap.com/audio/TalkisCheap/RA/fly_me_ss.rm
I believe it has multiple audio streams.

> Ronald

-- 
Regards,

Jai