On 01.03.2015 02:35, Michael Niedermayer wrote:
On Sat, Feb 28, 2015 at 11:40:30PM +0100, Andreas Cadhalpun wrote:
diff --git a/libavformat/rmenc.c b/libavformat/rmenc.c
index 838388f..9066f75 100644
--- a/libavformat/rmenc.c
+++ b/libavformat/rmenc.c
@@ -396,6 +396,10 @@ static int rm_write_video(AVFormatContext *s, const
uint8_t *buf, int size, int
/* Well, I spent some time finding the meaning of these bits. I am
not sure I understood everything, but it works !! */
#if 1
+ if (size > 0xFFFF - 7 - 4 - 12) {
+ av_log(s, AV_LOG_ERROR, "packet size %d too large\n", size);
+ return AVERROR(EINVAL);
I think the rm format is capable to handle larger frames, possibly
as multiple packets possible even as single ones not sure, see rmdec.c
so this would be a AVERROR_PATCHWELCOME
also see https://trac.ffmpeg.org/ticket/244
Yes, the rm format can contain larger frames split into slices and packed in
multiple packets. But currently the rv10/rv20 encoders always produce a whole
frame and the rm muxer always produces one packet per frame.
Attached is a new patch returning AVERROR_PATCHWELCOME.
Best regards,
Andreas
>From 5e4f4c9bf0440e7ad682c712773cefbf719b5734 Mon Sep 17 00:00:00 2001
From: Andreas Cadhalpun <andreas.cadhal...@googlemail.com>
Date: Mon, 2 Mar 2015 15:46:44 +0100
Subject: [PATCH] avformat/rm: limit packet size
The chunk size is limited to 0xFFFF (written by avio_wb16), so make
sure that the packet size is not too large.
Such large frames need to be split into slices smaller than 64 kB, but
that is currently supported neither by the rv10/rv20 encoders nor the rm
muxer.
Signed-off-by: Andreas Cadhalpun <andreas.cadhal...@googlemail.com>
---
libavformat/rmenc.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/libavformat/rmenc.c b/libavformat/rmenc.c
index 838388f..8763fff 100644
--- a/libavformat/rmenc.c
+++ b/libavformat/rmenc.c
@@ -396,6 +396,11 @@ static int rm_write_video(AVFormatContext *s, const uint8_t *buf, int size, int
/* Well, I spent some time finding the meaning of these bits. I am
not sure I understood everything, but it works !! */
#if 1
+ /* 0xFFFF is the maximal chunk size; header needs at most 7 + 4 + 12 B */
+ if (size > 0xFFFF - 7 - 4 - 12) {
+ av_log(s, AV_LOG_ERROR, "large packet size %d not supported\n", size);
+ return AVERROR_PATCHWELCOME;
+ }
write_packet_header(s, stream, size + 7 + (size >= 0x4000)*4, key_frame);
/* bit 7: '1' if final packet of a frame converted in several packets */
avio_w8(pb, 0x81);
--
2.1.4
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-devel
