diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2014-03-11 19:18:23 +0100 |
|---|---|---|
| committer | Carl Eugen Hoyos <cehoyos@ag.or.at> | 2014-03-13 07:31:59 +0100 |
| commit | 3e73bea05f71fbf8a4707436a48a5347fbd22260 (patch) | |
| tree | 4c2738d347fde8985115aa8c7bc81467152126a2 | |
| parent | 3712b398e9e987b171ee31799cbf1402dd8a52aa (diff) | |
| download | ffmpeg-3e73bea05f71fbf8a4707436a48a5347fbd22260.tar.gz | |
avformat/avidec: Check required demuxing buffer sizes in guess_ni_flag()
Fixes Ticket3421
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 5d75730c58f72918a41bb5abda4b448ecdd4273c)
| -rw-r--r-- | libavformat/avidec.c | 17 |
1 files changed, 14 insertions, 3 deletions
diff --git a/libavformat/avidec.c b/libavformat/avidec.c index b193a90a3d..6d731feac5 100644 --- a/libavformat/avidec.c +++ b/libavformat/avidec.c @@ -1532,6 +1532,7 @@ static int guess_ni_flag(AVFormatContext *s) return 0; for (min_pos=pos=0; min_pos!=INT64_MAX; pos= min_pos+1LU) { int64_t max_dts = INT64_MIN/2, min_dts= INT64_MAX/2; + int64_t max_buffer = 0; min_pos = INT64_MAX; for (i=0; i<s->nb_streams; i++) { @@ -1544,10 +1545,20 @@ static int guess_ni_flag(AVFormatContext *s) min_dts = FFMIN(min_dts, av_rescale_q(st->index_entries[idx[i]].timestamp/FFMAX(ast->sample_size, 1), st->time_base, AV_TIME_BASE_Q)); min_pos = FFMIN(min_pos, st->index_entries[idx[i]].pos); } - if (idx[i]) - max_dts = FFMAX(max_dts, av_rescale_q(st->index_entries[idx[i]-1].timestamp/FFMAX(ast->sample_size, 1), st->time_base, AV_TIME_BASE_Q)); } - if (max_dts - min_dts > 2*AV_TIME_BASE) { + for (i=0; i<s->nb_streams; i++) { + AVStream *st = s->streams[i]; + AVIStream *ast = st->priv_data; + + if (idx[i] && min_dts != INT64_MAX/2) { + int64_t dts = av_rescale_q(st->index_entries[idx[i]-1].timestamp/FFMAX(ast->sample_size, 1), st->time_base, AV_TIME_BASE_Q); + max_dts = FFMAX(max_dts, dts); + max_buffer = FFMAX(max_buffer, av_rescale(dts - min_dts, st->codec->bit_rate, AV_TIME_BASE)); + } + } + if (max_dts - min_dts > 2*AV_TIME_BASE || + max_buffer > 1024 * 1024 * 8 *8 + ) { av_free(idx); return 1; } |