PR #21234 opened by anders-mjoll
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21234
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21234.patch
After upgrading to FFmpeg 8.0 (from FFmpeg 5.1.2) we got some customers
reporting that FFmpeg consumed all the memory of the machine and was eventually
killed by the OS. I was able to track it down to the MOV demuxer not producing
any audio packets and the filter graph just caching up all the video frames
from the 70 GB MOV file. This in turn appears to be because the index is never
built for the audio stream. The reason it doesn't get built is because it fails
the following check in `mov_merge_tts_data`:
```
if (!sc->sample_count || sc->sample_count >= UINT_MAX / sizeof(*sc->tts_data))
return -1;
```
This happens because this MOV file contains PCM and in that case it appears
that the `sc->sample_count` is equal to the actual number of PCM samples not
the number of entries in the `stts` and `ctts` tables. This PR fixes this issue
by first obtaining the actual number of entries required by the ctts and stts
tables.
Unfortunately the file that triggers this problem is 70 GB and also contains
sensitive customer data so I cannot provide a sample to reproduce the problem.
>From 0c2d59273ba09c73a97fee64e86aa190367228b8 Mon Sep 17 00:00:00 2001
From: Anders Rein <[email protected]>
Date: Thu, 18 Dec 2025 18:59:17 +0100
Subject: [PATCH] avformat/mov: fixed bug in mov_merge_tts_data
Calculate the actual required size for the tts_data array instead of
assuming sc->sample_count reflect the number of entries in the stts/ctts
tables. This assumption does not hold for certain MOV files with PCM
audio.
---
libavformat/mov.c | 32 +++++++++++++++++++++++++-------
1 file changed, 25 insertions(+), 7 deletions(-)
diff --git a/libavformat/mov.c b/libavformat/mov.c
index 009ddfec80..be86878486 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -4637,25 +4637,43 @@ static int mov_merge_tts_data(MOVContext *mov, AVStream
*st, int flags)
int ctts = sc->ctts_data && (flags & MOV_MERGE_CTTS);
int stts = sc->stts_data && (flags & MOV_MERGE_STTS);
int idx = 0;
+ unsigned int ctts_total_count = 0;
+ unsigned int stts_total_count = 0;
+ unsigned int tts_count = 0;
if (!sc->ctts_data && !sc->stts_data)
return 0;
+
+ if (sc->ctts_data) {
+ for (unsigned int i = 0; i < sc->ctts_count; i++) {
+ ctts_total_count += sc->ctts_data[i].count;
+ }
+ }
+
+ if (sc->stts_data) {
+ for (unsigned int i = 0; i < sc->stts_count; i++) {
+ stts_total_count += sc->stts_data[i].count;
+ }
+ }
+
+ tts_count = FFMAX(ctts_total_count, stts_total_count);
+
// Expand time to sample entries such that we have a 1-1 mapping with
samples
- if (!sc->sample_count || sc->sample_count >= UINT_MAX /
sizeof(*sc->tts_data))
+ if (!tts_count || tts_count >= UINT_MAX / sizeof(*sc->tts_data))
return -1;
if (ctts) {
sc->tts_data = av_fast_realloc(NULL, &sc->tts_allocated_size,
- sc->sample_count *
sizeof(*sc->tts_data));
+ tts_count * sizeof(*sc->tts_data));
if (!sc->tts_data)
return -1;
memset(sc->tts_data, 0, sc->tts_allocated_size);
for (int i = 0; i < sc->ctts_count &&
- idx < sc->sample_count; i++)
+ idx < tts_count; i++)
for (int j = 0; j < sc->ctts_data[i].count &&
- idx < sc->sample_count; j++) {
+ idx < tts_count; j++) {
sc->tts_data[idx].offset = sc->ctts_data[i].offset;
sc->tts_data[idx++].count = 1;
}
@@ -4669,7 +4687,7 @@ static int mov_merge_tts_data(MOVContext *mov, AVStream
*st, int flags)
idx = 0;
if (stts) {
MOVTimeToSample *tts_data = av_fast_realloc(sc->tts_data,
&sc->tts_allocated_size,
- sc->sample_count *
sizeof(*sc->tts_data));
+ tts_count *
sizeof(*sc->tts_data));
if (!tts_data)
return -1;
@@ -4678,9 +4696,9 @@ static int mov_merge_tts_data(MOVContext *mov, AVStream
*st, int flags)
sc->tts_data = tts_data;
for (int i = 0; i < sc->stts_count &&
- idx < sc->sample_count; i++)
+ idx < tts_count; i++)
for (int j = 0; j < sc->stts_data[i].count &&
- idx < sc->sample_count; j++) {
+ idx < tts_count; j++) {
sc->tts_data[idx].duration = sc->stts_data[i].duration;
sc->tts_data[idx++].count = 1;
}
--
2.49.1
_______________________________________________
ffmpeg-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
