On 9/1/2020 12:03 PM, Derek Buitenhuis wrote:
> This also changes a check for mfra_size from < 0 to == 0, since
> it was always wrong, as avio_rb32 returns an unsigned integer.
mfra_size in this function was an int32_t, so storing the output of
avio_rb32() could end up with a negative value.
It'll no longer be the case now that you made mfra_size in MOVContext an
uint32_t.
>
> Signed-off-by: Derek Buitenhuis <derek.buitenh...@gmail.com>
> ---
> libavformat/mov.c | 10 +++++-----
> 1 file changed, 5 insertions(+), 5 deletions(-)
>
> diff --git a/libavformat/mov.c b/libavformat/mov.c
> index e33031f158..e901eb527f 100644
> --- a/libavformat/mov.c
> +++ b/libavformat/mov.c
> @@ -7499,22 +7499,22 @@ static int mov_read_mfra(MOVContext *c, AVIOContext
> *f)
> int64_t stream_size = avio_size(f);
> int64_t original_pos = avio_tell(f);
> int64_t seek_ret;
> - int32_t mfra_size;
> int ret = -1;
> if ((seek_ret = avio_seek(f, stream_size - 4, SEEK_SET)) < 0) {
> ret = seek_ret;
> goto fail;
> }
> - mfra_size = avio_rb32(f);
> - if (mfra_size < 0 || mfra_size > stream_size) {
> + c->mfra_size = avio_rb32(f);
> + c->have_read_mfra_size = 1;
> + if (c->mfra_size == 0 || c->mfra_size > stream_size) {
nit: !c->mfra_size.
> av_log(c->fc, AV_LOG_DEBUG, "doesn't look like mfra (unreasonable
> size)\n");
> goto fail;
> }
> - if ((seek_ret = avio_seek(f, -mfra_size, SEEK_CUR)) < 0) {
> + if ((seek_ret = avio_seek(f, -c->mfra_size, SEEK_CUR)) < 0) {
You may have to cast c->mfra_size to int64_t before negating it, or use
a local int64_t variable.
> ret = seek_ret;
> goto fail;
> }
> - if (avio_rb32(f) != mfra_size) {
> + if (avio_rb32(f) != c->mfra_size) {
> av_log(c->fc, AV_LOG_DEBUG, "doesn't look like mfra (size
> mismatch)\n");
> goto fail;
> }
>
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
