Calling ffio_ensure_seekback() if ffio_init_checksum() has been called
on the same context can lead to out of bounds memory accesses and
crashes. The reason is that ffio_ensure_seekback() does not update
checksum_ptr after reallocating the buffer, resulting in a dangling
pointer.
This effectively fixes potential crashes when opening mp3 files.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Don't prefix them ffio_url, which is misleading, sounding too
much like the urlprotocol layer (like ffurl_*).
Signed-off-by: Martin Storsjö <martin@martin.st>
* commit '8a273a746061a112e5e35066a8fd8e146d821a62':
avio: Add an internal utility function for freeing dynamic buffers
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '3c18a7b18807de81566381a1bcbe9f6103c0296b':
avio: Do not consider the end-of-buffer position valid
Conflicts:
libavformat/aviobuf.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Trigger a refill if the seek action moves the pointer
at the end of the buffer.
Before this patch the read action following the seek would trigger
the refill, while write action would write outside the buffer.
In the Libav codebase few muxers seek forward outside of what
already has been written so it is quite unlikely to experience
the problem with the default buffer size.
CC: libav-stable@libav.org
* commit 'd7f530b0d67fe3996dbfa990a47c865e0d1400a2':
aviobuf: check context before using it
See: 7441d1ec33
Merged-by: Michael Niedermayer <michaelni@gmx.at>
avio_flush() did nothing useful for read streams. Fix it to behave as
expected, and discard the currently read buffer properly.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
It's a public function and should use the avio_ namespace
Signed-off-by: James Almer <jamrial@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
C++ chokes on the definition of AVBPrint.
Including avio.h from c++ code used to work.
Fix trac ticket #3800.
Signed-off-by: Nicolas George <george@nsup.org>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
* commit '32d05934abc7427bb90380a4c1ab20a15fd7d821':
mp3dec: decode more data from Info header
Conflicts:
libavformat/mp3dec.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit 'd07b51bf0733fe58bbfa13c448775dc325463cb4':
aviobuf: Handle a NULL buffer in avio_close_dyn_buf
Merged-by: Michael Niedermayer <michaelni@gmx.at>
This simplifies proper error handling in rtsp.c/rtspdec.c. When
broadcasting over RTSP in TCP mode, the AVIOContext is closed and
recreated for each sent packet, and if the recreation fails, we might
try to close a NULL buffer when freeing things at the end.
Previously, if recreating the buffer in rtspdec.c failed, this would
crash later due to trying to close a NULL buffer.
Signed-off-by: Martin Storsjö <martin@martin.st>
When av_reallocp fails, the associated variables that keep track of
the number of elements in the array (and in some cases, the
separate number of allocated elements) need to be reset.
Not all of these might technically be needed, but it's better to
reset them if in doubt, to make sure variables don't end up
conflicting.
Signed-off-by: Martin Storsjö <martin@martin.st>
Null buffers are useful for simulating writing to a real buffer
for the sake of measuring how many bytes are written.
Signed-off-by: Martin Storsjö <martin@martin.st>
This provides at least some protection against potential accidental
corruption of AVIO buffer workspace.
Signed-off-by: Martin Storsjö <martin@martin.st>
* commit 'daf1e0d3de03bd424016e2a7520e4e94ece5c0ac':
avio: Add an internal function for reading without copying
Merged-by: Michael Niedermayer <michaelni@gmx.at>
As long as there is enough contiguous data in the avio buffer,
just return a pointer to it instead of copying it to the caller
provided buffer.
Signed-off-by: Martin Storsjö <martin@martin.st>
