[FFmpeg-devel] [PATCH] Fix issue when invalid nb_index_entries value is read - SPONSORED BY INA (Institut National de l'Audiovisuel)

[Marton Balint]

On Wed, 8 Mar 2023, Cédric Le Barz wrote:

>
> Fix issue when invalid nb_index_entries value is read : in case of false 
> nb_index_entries value, ffmpeg exit. This patch fix this problem.

What do you mean invalid? Is the value wrong, or is the file truncated in 
the middle of the index segment? From the patch it looks like the latter.

Is there a single unluckily truncated file that you want to fix with this 
patch, or multiple files can be affected by this fix because e.g. they 
are written by the same broken muxer?

Overall I am not sure if we want this applied, the user can also opt to 
avoid parsing all partitions with -seekable 0 and read / remux the file 
sequentially ignoring any index, so if somebody wants to rescue the data, 
it can be done as is.

Regards,
Marton

>
>
> Signed-off-by: Cedric Le Barz <clebarz at ektacom.com>
> ---
>  ffmpeg/libavformat/mxfdec.c | 14 ++++++++++++--
>  1 file changed, 12 insertions(+), 2 deletions(-)
>
> diff --git a/ffmpeg/libavformat/mxfdec.c b/ffmpeg/libavformat/mxfdec.c
> index 4530617..ffc8987 100644
> --- a/ffmpeg/libavformat/mxfdec.c
> +++ b/ffmpeg/libavformat/mxfdec.c
> @@ -1221,8 +1221,18 @@ static int mxf_read_index_entry_array(AVIOContext *pb, 
> MXFIndexTableSegment *seg
>      }
>      for (i = 0; i < segment->nb_index_entries; i++) {
> -        if(avio_feof(pb))
> -            return AVERROR_INVALIDDATA;
> +
> +        if(avio_feof(pb)) {
> +            if (i == 0) {
> +                return AVERROR_INVALIDDATA;
> +            } else {
> +                /* To be more robust to invalid nb_index_entries value,
> +                   fix the index entry number according to read entries */
> +                segment->nb_index_entries = i;
> +                return 0;
> +            }
> +        }
> +
>          segment->temporal_offset_entries[i] = avio_r8(pb);
>          avio_r8(pb);                                        /* 
> KeyFrameOffset */
>         segment->flag_entries[i] = avio_r8(pb);
> -- 
> 2.34.1
>
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel at ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
>
> To unsubscribe, visit link above, or email
> ffmpeg-devel-request at ffmpeg.org with subject "unsubscribe".
>
>