[FFmpeg-devel] Issue on libavformat/aviobuf.c

[Baptiste Coudurier]

Uoti Urpala wrote:
> On Wed, 2008-09-24 at 17:59 +0000, Andrew Wason wrote:
>> Baptiste Coudurier <baptiste.coudurier <at> smartjog.com> writes:
>>> Cannot reproduce the behavior using FFmpeg latest svn, possibly this
>>> issue is related to mplayer ?
>>
>> This sounds like mplayer bug http://bugzilla.mplayerhq.hu/show_bug.cgi?id=1267
>>
>> I attached a patch to that bug report which has been working for me.
> 
> What exactly is the MPlayer bug that is supposed to fix? That seeking to
> a position past the end of the file does not work?
> 
> Even if it's only triggered by MPlayer in this case 

I guess a different bug is triggered in MPlayer, and seems only in
MPlayer, since FFmpeg is not impacted.

> there is a real bug
> in the libavformat mov demuxer. mov_read_udta() has this code:
> 
>         uint32_t tag_size = get_be32(pb);
>         uint32_t tag      = get_le32(pb);
>         uint64_t next     = url_ftell(pb) + tag_size - 8;
> 
>         if (next > end) // stop if tag_size is wrong
>             break;
> 
> A sanity check for minimum tag size is missing. The code accepts
> tag_size 0, and will then be stuck reading the same "0-sized" atom
> without advancing in the stream.

Should be fixed.

-- 
Baptiste COUDURIER                              GnuPG Key Id: 0x5C1ABAAA
Smartjog USA Inc.                                http://www.smartjog.com
Key fingerprint                 8D77134D20CC9220201FC5DB0AC9325C5C1ABAAA