[FFmpeg-devel] [libav-devel] [PATCH] avformat/rmenc: limit packet size

[Andreas Cadhalpun]

On 01.03.2015 21:18, Diego Biurrun wrote:
> On Sat, Feb 28, 2015 at 11:40:30PM +0100, Andreas Cadhalpun wrote:
>>  From 4bb0687f07713787f83dcd90214ad32b91c0f91f Mon Sep 17 00:00:00 2001
>> From: Andreas Cadhalpun <Andreas.Cadhalpun at googlemail.com>
>> Date: Sat, 28 Feb 2015 23:11:50 +0100
>> Subject: [PATCH] avformat/rmenc: limit packet size
>
> Just "rm" is enough to denote the module.

OK.

>> --- a/libavformat/rmenc.c
>> +++ b/libavformat/rmenc.c
>> @@ -396,6 +396,10 @@ static int rm_write_video(AVFormatContext *s, const uint8_t *buf, int size, int
>>       /* Well, I spent some time finding the meaning of these bits. I am
>>          not sure I understood everything, but it works !! */
>>   #if 1
>> +    if (size > 0xFFFF - 7 - 4 - 12) {
>
> That looks slightly magicky ...  What are those numbers?

Well, 0xFFFF is the maximal size for avio_wb16 and then one has to subtract the 
maximal size of the header.
The 7 and 4 come from:
write_packet_header(s, stream, size + 7 + (size >= 0x4000)*4, key_frame);

And in write_packet_header there is the 12:
     avio_wb16(s,length + 12);

>> +        av_log(s, AV_LOG_ERROR, "packet size %d too large\n", size);
>> +        return AVERROR(EINVAL);
>
> INVALIDDATA

Since the format could actually support such large frames, it's really 
AVERROR_PATCHWELCOME.

Best regards,
Andreas