[FFmpeg-devel] [PATCH] avformat/rmenc: limit packet size

[Andreas Cadhalpun]

On 01.03.2015 02:35, Michael Niedermayer wrote:
> On Sat, Feb 28, 2015 at 11:40:30PM +0100, Andreas Cadhalpun wrote:
>> diff --git a/libavformat/rmenc.c b/libavformat/rmenc.c
>> index 838388f..9066f75 100644
>> --- a/libavformat/rmenc.c
>> +++ b/libavformat/rmenc.c
>> @@ -396,6 +396,10 @@ static int rm_write_video(AVFormatContext *s, const uint8_t *buf, int size, int
>>       /* Well, I spent some time finding the meaning of these bits. I am
>>          not sure I understood everything, but it works !! */
>>   #if 1
>> +    if (size > 0xFFFF - 7 - 4 - 12) {
>> +        av_log(s, AV_LOG_ERROR, "packet size %d too large\n", size);
>> +        return AVERROR(EINVAL);
>
> I think the rm format is capable to handle larger frames, possibly
> as multiple packets possible even as single ones not sure, see rmdec.c
>
> so this would be a AVERROR_PATCHWELCOME
> also see https://trac.ffmpeg.org/ticket/244

Yes, the rm format can contain larger frames split into slices and packed in 
multiple packets. But currently the rv10/rv20 encoders always produce a whole 
frame and the rm muxer always produces one packet per frame.

Attached is a new patch returning AVERROR_PATCHWELCOME.

Best regards,
Andreas
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-avformat-rm-limit-packet-size.patch
Type: text/x-diff
Size: 1432 bytes
Desc: not available
URL: <https://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20150302/6eaaf4fb/attachment.bin>