This is an automated email from the git hooks/post-receive script.

Git pushed a commit to branch master
in repository ffmpeg.

commit 83412412a492911609a61c4782e3d9364d9c2b2f
Author:     Niklas Haas <[email protected]>
AuthorDate: Fri Aug 14 15:47:27 2026 +0200
Commit:     Niklas Haas <[email protected]>
CommitDate: Mon Aug 31 19:10:45 2026 +0000

    avformat/shared: don't re-read spacemap block size per call
    
    This would otherwise trigger OOB/UB if the spacemap header is corrupted.
    Instead, read it once during init, verify it there, and then cache that
    file for the remainder of the process.
    
    Sponsored-by: nxtedition AB
    Reported-by: Mateusz Gierblinski <[email protected]>
    Signed-off-by: Niklas Haas <[email protected]>
---
 libavformat/shared.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/libavformat/shared.c b/libavformat/shared.c
index 85c4063391..9863384a3d 100644
--- a/libavformat/shared.c
+++ b/libavformat/shared.c
@@ -156,7 +156,7 @@ typedef struct SharedContext {
 
     /* options */
     char *cache_dir;
-    int block_shift; ///< requested shift; may disagree with actual
+    int block_shift; ///< requested shift; updated on init if it disagrees
     int read_only;
     int64_t timeout;
     int retry_errors;
@@ -295,7 +295,8 @@ static int shared_open(URLContext *h, const char *arg, int 
flags, AVDictionary *
     if (ret < 0)
         goto fail;
 
-    s->block_size = 1 << atomic_load(&s->spacemap->block_shift);
+    /* s->block_shift is fully settled after spacemap_init() */
+    s->block_size = 1 << s->block_shift;
 
     int64_t filesize = get_filesize(h);
     if (!filesize) {
@@ -313,7 +314,7 @@ static int shared_open(URLContext *h, const char *arg, int 
flags, AVDictionary *
 
     if (filesize > 0) {
         int64_t last_pos = filesize - 1;
-        int64_t last_block = last_pos >> 
atomic_load(&s->spacemap->block_shift);
+        int64_t last_block = last_pos >> s->block_shift;
         ret = spacemap_grow(h, last_block);
         if (ret < 0)
             goto fail;
@@ -513,6 +514,7 @@ static int spacemap_init(URLContext *h, const uint8_t 
hash[HASH_SIZE])
             av_log(h, AV_LOG_ERROR, "Invalid block shift %d in cache file!\n", 
shift);
             return AVERROR(EINVAL);
         }
+        s->block_shift = shift;
     }
 
     for (int i = 0; i < HASH_SIZE; i++) {
@@ -603,8 +605,7 @@ static int shared_read(URLContext *h, unsigned char *buf, 
int size)
     if (size <= 0)
         return AVERROR_EOF;
 
-    const int shift = atomic_load_explicit(&s->spacemap->block_shift, 
memory_order_relaxed);
-    const int64_t block_id = s->pos >> shift;
+    const int64_t block_id = s->pos >> s->block_shift;
     const int64_t offset = s->pos & (s->block_size - 1);
     const int64_t block_pos = block_id * s->block_size;
     int block_size = clamp_size(h, s->block_size, block_pos);

-- 
To stop receiving notification emails like this one, please contact
[email protected].
_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]

Reply via email to