github-mirrors/FFmpeg
1
0
Fork 0
mirror of https://mirror.skon.top/https://github.com/FFmpeg/FFmpeg synced 2026-04-20 21:00:41 +08:00
Code Issues Packages Projects Releases Wiki Activity

avformat/aviobuf: return error for ffio_close_null_buf() if written bytes exceed INT_MAX

Browse Source 
Also check return value where it is used.

Signed-off-by: Marton Balint <cus@passwd.hu>
This commit is contained in:
Marton Balint
2025-12-25 20:03:32 +01:00
parent af136db1c3
commit c80d3b35ae
3 changed files with 10 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
libavformat/avio_internal.h
View File

@@ -259,7 +259,7 @@ int ffio_open_whitelist(AVIOContext **s, const char *url, int flags,
* Close a null buffer.
*
* @param s an IO context opened by ffio_open_null_buf
* @return the number of bytes written to the null buffer
* @return the number of bytes written to the null buffer, negative on error
*/
int ffio_close_null_buf(AVIOContext *s);

4
libavformat/aviobuf.c
View File

@@ -1451,6 +1451,8 @@ static int null_buf_write(void *opaque, const uint8_t *buf, int buf_size)
{
DynBuffer *d = opaque;
if ((unsigned)d->pos + (unsigned)buf_size > INT_MAX)
return AVERROR(ERANGE);
d->pos += buf_size;
if (d->pos > d->size)
d->size = d->pos;
@@ -1474,7 +1476,7 @@ int ffio_close_null_buf(AVIOContext *s)
avio_flush(s);
size = d->size;
size = s->error ? s->error : d->size;
avio_context_free(&s);

7
libavformat/movenc.c
View File

@@ -5845,8 +5845,11 @@ static int mov_write_sidx_tags(AVIOContext *pb, MOVMuxContext *mov,
total_size -= mov_write_sidx_tag(avio_buf, track, ref_size,
total_size);
}
if (round == 0)
if (round == 0) {
total_size = ffio_close_null_buf(avio_buf);
if (total_size < 0)
return total_size;
}
}
return 0;
}
@@ -5911,6 +5914,8 @@ static int mov_write_moof_tag(AVIOContext *pb, MOVMuxContext *mov, int tracks,
return ret;
mov_write_moof_tag_internal(avio_buf, mov, tracks, 0);
moof_size = ffio_close_null_buf(avio_buf);
if (moof_size < 0)
return moof_size;
if (mov->flags & FF_MOV_FLAG_DASH &&
!(mov->flags & (FF_MOV_FLAG_GLOBAL_SIDX | FF_MOV_FLAG_SKIP_SIDX)))