virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-08-10 06:10:52 +02:00
Code Issues Releases Activity

avformat/mpegts: pass MpegTSContext ptr explicitly (fixes #3721)

Browse Source 
AVFormatContext->priv_data is not always a MpegTSContext, it can be
RTSPState when decoding a RTP stream. So it is necessary to pass
MpegTSContext pointer explicitly.

This fixes memory corruption from bug #3721 (RTSPState is smaller than
MpegTSContext thus innocent memory gets overwritten).

Signed-off-by: Alexander V. Lukyanov <lavv17f@gmail.com>
Reviewed-by: Marton Balint <cus@passwd.hu>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Alexander V. Lukyanov
2014-07-08 11:54:15 +04:00
committed by Michael Niedermayer
parent fd3388d63d
commit 8635954335
1 changed files with 4 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
libavformat/mpegts.c
View File

@@ -357,10 +357,9 @@ static int discard_pid(MpegTSContext *ts, unsigned int pid)
* Assemble PES packets out of TS packets, and then call the "section_cb" * Assemble PES packets out of TS packets, and then call the "section_cb"
* function when they are complete. * function when they are complete.
*/ */
static void write_section_data(AVFormatContext *s, MpegTSFilter *tss1, static void write_section_data(MpegTSContext *ts, MpegTSFilter *tss1,
const uint8_t *buf, int buf_size, int is_start) const uint8_t *buf, int buf_size, int is_start)
{ {
MpegTSContext *ts = s->priv_data;
MpegTSSectionFilter *tss = &tss1->u.section_filter; MpegTSSectionFilter *tss = &tss1->u.section_filter;
int len; int len;
@@ -2010,7 +2009,6 @@ static int parse_pcr(int64_t *ppcr_high, int *ppcr_low,
/* handle one TS packet */ /* handle one TS packet */
static int handle_packet(MpegTSContext *ts, const uint8_t *packet) static int handle_packet(MpegTSContext *ts, const uint8_t *packet)
{ {
AVFormatContext *s = ts->stream;
MpegTSFilter *tss; MpegTSFilter *tss;
int len, pid, cc, expected_cc, cc_ok, afc, is_start, is_discontinuity, int len, pid, cc, expected_cc, cc_ok, afc, is_start, is_discontinuity,
has_adaptation, has_payload; has_adaptation, has_payload;
@@ -2084,7 +2082,7 @@ static int handle_packet(MpegTSContext *ts, const uint8_t *packet)
return 0; return 0;
if (len && cc_ok) { if (len && cc_ok) {
/* write remaining section bytes */ /* write remaining section bytes */
write_section_data(s, tss, write_section_data(ts, tss,
p, len, 0); p, len, 0);
/* check whether filter has been closed */ /* check whether filter has been closed */
if (!ts->pids[pid]) if (!ts->pids[pid])
@@ -2092,12 +2090,12 @@ static int handle_packet(MpegTSContext *ts, const uint8_t *packet)
} }
p += len; p += len;
if (p < p_end) { if (p < p_end) {
write_section_data(s, tss, write_section_data(ts, tss,
p, p_end - p, 1); p, p_end - p, 1);
} }
} else { } else {
if (cc_ok) { if (cc_ok) {
write_section_data(s, tss, write_section_data(ts, tss,
p, p_end - p, 0); p, p_end - p, 0);
} }
} }