virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-08-10 06:10:52 +02:00
Code Issues Releases Activity

avformat/mov: Don't use entry[-1] in pointer arithmetic

Browse Source 
It is undefined behaviour.
Fixes many failed tests with UBSan and GCC 13 like
"src/libavformat/mov.c:4229:44: runtime error: store to address
0x5572abe20f80 with insufficient space for an object of type 'struct
MOVIndexRange'"
(The line number does not refer to the line where &entry[-1]
is assigned.)

Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
This commit is contained in:
Andreas Rheinhardt
2024-02-26 22:37:04 +01:00
parent 9d7d03ea45
commit 1bb7d5ca9f
1 changed files with 6 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
libavformat/mov.c
View File

@@ -4022,7 +4022,7 @@ static void mov_fix_index(MOVContext *mov, AVStream *st)
int num_discarded_begin = 0; int num_discarded_begin = 0;
int first_non_zero_audio_edit = -1; int first_non_zero_audio_edit = -1;
int packet_skip_samples = 0; int packet_skip_samples = 0;
MOVIndexRange *current_index_range; MOVIndexRange *current_index_range = NULL;
int found_keyframe_after_edit = 0; int found_keyframe_after_edit = 0;
int found_non_empty_edit = 0; int found_non_empty_edit = 0;
@@ -4038,7 +4038,6 @@ static void mov_fix_index(MOVContext *mov, AVStream *st)
return; return;
} }
msc->current_index_range = msc->index_ranges; msc->current_index_range = msc->index_ranges;
current_index_range = msc->index_ranges - 1;
// Clean AVStream from traces of old index // Clean AVStream from traces of old index
sti->index_entries = NULL; sti->index_entries = NULL;
@@ -4225,8 +4224,9 @@ static void mov_fix_index(MOVContext *mov, AVStream *st)
} }
// Update the index ranges array // Update the index ranges array
if (current_index_range < msc->index_ranges || index != current_index_range->end) { if (!current_index_range || index != current_index_range->end) {
current_index_range++; current_index_range = current_index_range ? current_index_range + 1
: msc->index_ranges;
current_index_range->start = index; current_index_range->start = index;
} }
current_index_range->end = index + 1; current_index_range->end = index + 1;
@@ -4289,7 +4289,8 @@ static void mov_fix_index(MOVContext *mov, AVStream *st)
av_freep(&frame_duration_buffer); av_freep(&frame_duration_buffer);
// Null terminate the index ranges array // Null terminate the index ranges array
current_index_range++; current_index_range = current_index_range ? current_index_range + 1
: msc->index_ranges;
current_index_range->start = 0; current_index_range->start = 0;
current_index_range->end = 0; current_index_range->end = 0;
msc->current_index = msc->index_ranges[0].start; msc->current_index = msc->index_ranges[0].start;