github
/
mpv
mirror of https://github.com/mpv-player/mpv
1
Fork 0
Code Releases Activity

demux_lavf: fix API usage 

avio_alloc_context() is documented to require an av_malloc'ed buffer. It
appears libavformat can even reallocate the buffer while it is probing,
so passing a static buffer can in theory lead to crashes.

I couldn't reproduce such a crash, but apparently it happened to
mplayer-svn. This commit follows the mplayer fix in svn commit r36397.
This commit is contained in:
wm4 2013-08-04 23:21:50 +02:00
parent 56fec5ad3a
commit b53497a403
1 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
demux/demux_lavf.c
View File

@ -76,7 +76,6 @@ typedef struct lavf_priv {
AVInputFormat *avif;
AVFormatContext *avfc;
AVIOContext *pb;
uint8_t buffer[BIO_BUFFER_SIZE];
int64_t last_pts;
struct sh_stream **streams; // NULL for unknown streams
int num_streams;
@ -571,8 +570,15 @@ static int demux_open_lavf(demuxer_t *demuxer, enum demux_check check)
if (!(priv->avif->flags & AVFMT_NOFILE) &&
demuxer->stream->type != STREAMTYPE_AVDEVICE)
{
priv->pb = avio_alloc_context(priv->buffer, BIO_BUFFER_SIZE, 0,
void *buffer = av_malloc(BIO_BUFFER_SIZE);
if (!buffer)
return -1;
priv->pb = avio_alloc_context(buffer, BIO_BUFFER_SIZE, 0,
demuxer, mp_read, NULL, mp_seek);
if (!priv->pb) {
av_free(buffer);
return -1;
}
priv->pb->read_seek = mp_read_seek;
priv->pb->seekable = demuxer->stream->end_pos
&& (demuxer->stream->flags & MP_STREAM_SEEK) == MP_STREAM_SEEK
@ -970,6 +976,8 @@ static void demux_close_lavf(demuxer_t *demuxer)
av_freep(&priv->avfc->key);
avformat_close_input(&priv->avfc);
}
if (priv->pb)
av_freep(&priv->pb->buffer);
av_freep(&priv->pb);
talloc_free(priv);
demuxer->priv = NULL;