Module: ffmpeg Branch: master Commit: e360ada2d13af36ab7afd9ebcd2bd236d23d9b96
Author: Martin Storsjö <[email protected]> Committer: Luca Barbato <[email protected]> Date: Sun Feb 27 01:02:32 2011 +0200 aviobuf: Write new data at s->buf_end in fill_buffer In most cases, s->buf_ptr will be equal to s->buf_end when fill_buffer is called, but this may not always be the case, if we're seeking forward by reading (permitted by the short seek threshold). If fill_buffer is writing to s->buf_ptr instead of s->buf_end (when they aren't equal and s->buf_ptr is ahead of s->buffer), the data between s->buf_ptr and s->buf_end is overwritten, leading to inconsistent buffer content. This could return incorrect data if later seeking back into the area before the current s->buf_ptr. Signed-off-by: Luca Barbato <[email protected]> --- libavformat/aviobuf.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/libavformat/aviobuf.c b/libavformat/aviobuf.c index 0c733a7..3f3721c 100644 --- a/libavformat/aviobuf.c +++ b/libavformat/aviobuf.c @@ -468,7 +468,7 @@ void put_tag(AVIOContext *s, const char *tag) static void fill_buffer(AVIOContext *s) { - uint8_t *dst= !s->max_packet_size && s->buf_end - s->buffer < s->buffer_size ? s->buf_ptr : s->buffer; + uint8_t *dst= !s->max_packet_size && s->buf_end - s->buffer < s->buffer_size ? s->buf_end : s->buffer; int len= s->buffer_size - (dst - s->buffer); int max_buffer_size = s->max_packet_size ? s->max_packet_size : IO_BUFFER_SIZE; _______________________________________________ ffmpeg-commits mailing list [email protected] https://lists.mplayerhq.hu/mailman/listinfo/ffmpeg-commits
