This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch master in repository ffmpeg.
commit 83412412a492911609a61c4782e3d9364d9c2b2f Author: Niklas Haas <[email protected]> AuthorDate: Fri Aug 14 15:47:27 2026 +0200 Commit: Niklas Haas <[email protected]> CommitDate: Mon Aug 31 19:10:45 2026 +0000 avformat/shared: don't re-read spacemap block size per call This would otherwise trigger OOB/UB if the spacemap header is corrupted. Instead, read it once during init, verify it there, and then cache that file for the remainder of the process. Sponsored-by: nxtedition AB Reported-by: Mateusz Gierblinski <[email protected]> Signed-off-by: Niklas Haas <[email protected]> --- libavformat/shared.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/libavformat/shared.c b/libavformat/shared.c index 85c4063391..9863384a3d 100644 --- a/libavformat/shared.c +++ b/libavformat/shared.c @@ -156,7 +156,7 @@ typedef struct SharedContext { /* options */ char *cache_dir; - int block_shift; ///< requested shift; may disagree with actual + int block_shift; ///< requested shift; updated on init if it disagrees int read_only; int64_t timeout; int retry_errors; @@ -295,7 +295,8 @@ static int shared_open(URLContext *h, const char *arg, int flags, AVDictionary * if (ret < 0) goto fail; - s->block_size = 1 << atomic_load(&s->spacemap->block_shift); + /* s->block_shift is fully settled after spacemap_init() */ + s->block_size = 1 << s->block_shift; int64_t filesize = get_filesize(h); if (!filesize) { @@ -313,7 +314,7 @@ static int shared_open(URLContext *h, const char *arg, int flags, AVDictionary * if (filesize > 0) { int64_t last_pos = filesize - 1; - int64_t last_block = last_pos >> atomic_load(&s->spacemap->block_shift); + int64_t last_block = last_pos >> s->block_shift; ret = spacemap_grow(h, last_block); if (ret < 0) goto fail; @@ -513,6 +514,7 @@ static int spacemap_init(URLContext *h, const uint8_t hash[HASH_SIZE]) av_log(h, AV_LOG_ERROR, "Invalid block shift %d in cache file!\n", shift); return AVERROR(EINVAL); } + s->block_shift = shift; } for (int i = 0; i < HASH_SIZE; i++) { @@ -603,8 +605,7 @@ static int shared_read(URLContext *h, unsigned char *buf, int size) if (size <= 0) return AVERROR_EOF; - const int shift = atomic_load_explicit(&s->spacemap->block_shift, memory_order_relaxed); - const int64_t block_id = s->pos >> shift; + const int64_t block_id = s->pos >> s->block_shift; const int64_t offset = s->pos & (s->block_size - 1); const int64_t block_pos = block_id * s->block_size; int block_size = clamp_size(h, s->block_size, block_pos); -- To stop receiving notification emails like this one, please contact [email protected]. _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
