[FFmpeg-cvslog] avformat/mxfdec: detect loops during header parsing

Michael Niedermayer git at videolan.org
Wed Jan 8 10:28:33 CET 2014


ffmpeg | branch: release/2.1 | Michael Niedermayer <michaelni at gmx.at> | Wed Jan  8 04:49:50 2014 +0100| [de14fe7e297f1e73223a9594e1fb3ff4fc7b529e] | committer: Carl Eugen Hoyos

avformat/mxfdec: detect loops during header parsing

The header parser uses forward and backward parsing, making the
bulletproof prevention of loops difficult, thus this simple
detection code.
If someone improves the forward/backward parsing so it cannot loop
then this commit should be reverted

Fixes Ticket3278

Signed-off-by: Michael Niedermayer <michaelni at gmx.at>
(cherry picked from commit 1c010fd035c1a14dc73827b84f21f593e969a5d6)

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=de14fe7e297f1e73223a9594e1fb3ff4fc7b529e
---

 libavformat/mxfdec.c |    9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c
index d0cbeea..3d87e96 100644
--- a/libavformat/mxfdec.c
+++ b/libavformat/mxfdec.c
@@ -2005,6 +2005,8 @@ static int mxf_read_header(AVFormatContext *s)
     MXFContext *mxf = s->priv_data;
     KLVPacket klv;
     int64_t essence_offset = 0;
+    int64_t last_pos = -1;
+    uint64_t last_pos_index = 1;
     int ret;
 
     mxf->last_forward_tell = INT64_MAX;
@@ -2022,7 +2024,12 @@ static int mxf_read_header(AVFormatContext *s)
 
     while (!url_feof(s->pb)) {
         const MXFMetadataReadTableEntry *metadata;
-
+        if (avio_tell(s->pb) == last_pos) {
+            av_log(mxf->fc, AV_LOG_ERROR, "MXF structure loop detected\n");
+            return AVERROR_INVALIDDATA;
+        }
+        if ((1ULL<<61) % last_pos_index++ == 0)
+            last_pos = avio_tell(s->pb);
         if (klv_read_packet(&klv, s->pb) < 0) {
             /* EOF - seek to previous partition or stop */
             if(mxf_parse_handle_partition_or_eof(mxf) <= 0)



More information about the ffmpeg-cvslog mailing list