mirror of
https://github.com/FFmpeg/FFmpeg.git
synced 2025-03-17 20:17:55 +02:00
avformat/mpegts: Shuffle avio_seek
This avoids accessing an old, no longer valid buffer. Fixes: out of array access Fixes: crash_audio-2020 Found-by: le wu <shoulewoba@gmail.com> Reviewed-by: Marton Balint <cus@passwd.hu> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit cd74af14162c803f18e90bb12b52135e893d990c) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
parent
4077647a8f
commit
57ef3712d7
@ -2416,15 +2416,16 @@ static int mpegts_resync(AVFormatContext *s, int seekback, const uint8_t *curren
|
||||
AVIOContext *pb = s->pb;
|
||||
int c, i;
|
||||
uint64_t pos = avio_tell(pb);
|
||||
|
||||
avio_seek(pb, -FFMIN(seekback, pos), SEEK_CUR);
|
||||
int64_t back = FFMIN(seekback, pos);
|
||||
|
||||
//Special case for files like 01c56b0dc1.ts
|
||||
if (current_packet[0] == 0x80 && current_packet[12] == 0x47) {
|
||||
avio_seek(pb, 12, SEEK_CUR);
|
||||
avio_seek(pb, 12 - back, SEEK_CUR);
|
||||
return 0;
|
||||
}
|
||||
|
||||
avio_seek(pb, -back, SEEK_CUR);
|
||||
|
||||
for (i = 0; i < ts->resync_size; i++) {
|
||||
c = avio_r8(pb);
|
||||
if (avio_feof(pb))
|
||||
|
Loading…
x
Reference in New Issue
Block a user