Patches attached.
- Andreas
From 95e88893123bae89991bf45a6c5db0173e158574 Mon Sep 17 00:00:00 2001
From: Andreas Rheinhardt <andreas.rheinha...@outlook.com>
Date: Sun, 8 Jun 2025 00:52:46 +0200
Subject: [PATCH 1/3] avformat/dhav: Fix check for seekability
AVIOContext.seekable is a bitfield. Also check for seekability
earlier.
Signed-off-by: Andreas Rheinhardt <andreas.rheinha...@outlook.com>
---
libavformat/dhav.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/libavformat/dhav.c b/libavformat/dhav.c
index 31f4d75181..af1a8d86a5 100644
--- a/libavformat/dhav.c
+++ b/libavformat/dhav.c
@@ -237,6 +237,9 @@ static void get_timeinfo(unsigned date, struct tm *timeinfo)
static int64_t get_duration(AVFormatContext *s)
{
+ if (!(s->pb->seekable & AVIO_SEEKABLE_NORMAL))
+ return 0;
+
int64_t start_pos = avio_tell(s->pb);
int64_t end_pos = -1;
int64_t start = 0, end = 0;
@@ -248,9 +251,6 @@ static int64_t get_duration(AVFormatContext *s)
unsigned date;
int64_t size = avio_size(s->pb);
- if (!s->pb->seekable)
- return 0;
-
if (start_pos + 16 > size)
return 0;
--
2.45.2
From 39df5a583d781d54dcac57b9d024d256d4310172 Mon Sep 17 00:00:00 2001
From: Derek Buitenhuis <derek.buitenh...@gmail.com>
Date: Fri, 6 Jun 2025 14:44:50 +0100
Subject: [PATCH 2/3] avformat/dhav: Add missed free for end_buffer
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Accidentally left out of 36ec9217e6dca3432304c9d76078d9618247eb0f.
Found-by: Kacper Michajłow <kaspe...@gmail.com>
Signed-off-by: Derek Buitenhuis <derek.buitenh...@gmail.com>
---
libavformat/dhav.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/libavformat/dhav.c b/libavformat/dhav.c
index af1a8d86a5..ffd6d66359 100644
--- a/libavformat/dhav.c
+++ b/libavformat/dhav.c
@@ -281,6 +281,7 @@ static int64_t get_duration(AVFormatContext *s)
}
if (end_pos < 0 || end_pos + 16 > end_buffer_pos + end_buffer_size) {
+ av_freep(&end_buffer);
avio_seek(s->pb, start_pos, SEEK_SET);
return 0;
}
@@ -289,6 +290,8 @@ static int64_t get_duration(AVFormatContext *s)
get_timeinfo(date, &timeinfo);
end = av_timegm(&timeinfo) * 1000LL;
+ av_freep(&end_buffer);
+
avio_seek(s->pb, start_pos, SEEK_SET);
return end - start;
--
2.45.2
From 28c1a8ebcadec6ba168664b5ece9e09159feb255 Mon Sep 17 00:00:00 2001
From: Andreas Rheinhardt <andreas.rheinha...@outlook.com>
Date: Sun, 8 Jun 2025 01:07:02 +0200
Subject: [PATCH 3/3] avformat/dhav: Check reading data
Prevents potential use of uninitialized data.
Signed-off-by: Andreas Rheinhardt <andreas.rheinha...@outlook.com>
---
libavformat/dhav.c | 20 ++++++++++----------
1 file changed, 10 insertions(+), 10 deletions(-)
diff --git a/libavformat/dhav.c b/libavformat/dhav.c
index ffd6d66359..9bdb23322d 100644
--- a/libavformat/dhav.c
+++ b/libavformat/dhav.c
@@ -261,13 +261,12 @@ static int64_t get_duration(AVFormatContext *s)
end_buffer_size = FFMIN(MAX_DURATION_BUFFER_SIZE, size);
end_buffer = av_malloc(end_buffer_size);
- if (!end_buffer) {
- avio_seek(s->pb, start_pos, SEEK_SET);
- return 0;
- }
+ if (!end_buffer)
+ goto fail;
end_buffer_pos = size - end_buffer_size;
avio_seek(s->pb, end_buffer_pos, SEEK_SET);
- avio_read(s->pb, end_buffer, end_buffer_size);
+ if (ffio_read_size(s->pb, end_buffer, end_buffer_size) < 0)
+ goto fail;
offset = end_buffer_size - 8;
while (offset > 0) {
@@ -280,11 +279,8 @@ static int64_t get_duration(AVFormatContext *s)
}
}
- if (end_pos < 0 || end_pos + 16 > end_buffer_pos + end_buffer_size) {
- av_freep(&end_buffer);
- avio_seek(s->pb, start_pos, SEEK_SET);
- return 0;
- }
+ if (end_pos < 0 || end_pos + 16 > end_buffer_pos + end_buffer_size)
+ goto fail;
date = AV_RL32(end_buffer + (end_pos - end_buffer_pos) + 16);
get_timeinfo(date, &timeinfo);
@@ -295,6 +291,10 @@ static int64_t get_duration(AVFormatContext *s)
avio_seek(s->pb, start_pos, SEEK_SET);
return end - start;
+fail:
+ av_freep(&end_buffer);
+ avio_seek(s->pb, start_pos, SEEK_SET);
+ return 0;
}
static int dhav_read_header(AVFormatContext *s)
--
2.45.2
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
