[FFmpeg-devel] [PATCH] avformat/mxfenc: Discard audio until valid video has been received

[Andreas Rheinhardt]

Normally, video packets are muxed before audio packets for mxf (there is
a dedicated interleave function for this); furthermore the first (video)
packet triggers writing the actual header. Yet when the first video packet
fails the checks performed on it, codec_ul (a value set based upon
properties of the bitstream which necessitates actually inspecting
packets) may be NULL; the next packet written (an audio packet) will then
trigger outputting the header and this leads to a segfault because
codec_ul is dereferenced (this is ticket #7993). Therefore this commit
discards audio packets until a valid video packet has been received,
fixing said ticket.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt at gmail.com>
---
This implements what I had originally in mind to fix said ticket and it
is also what Baptiste Coudurier wanted [1]. The main obstacle in fixing
it was fixing the mxf-d10-user-comments test (with this patch, the old
test would output nothing at all).

[1]: https://ffmpeg.org/pipermail/ffmpeg-devel/2020-March/257900.html

 libavformat/mxfenc.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/libavformat/mxfenc.c b/libavformat/mxfenc.c
index d8678c9d25..2b0b7342a7 100644
--- a/libavformat/mxfenc.c
+++ b/libavformat/mxfenc.c
@@ -2843,6 +2843,13 @@ static int mxf_write_packet(AVFormatContext *s, AVPacket *pkt)
     MXFIndexEntry ie = {0};
     int err;
 
+    if (!mxf->header_written && pkt->stream_index != 0 &&
+        s->oformat != &ff_mxf_opatom_muxer) {
+        av_log(s, AV_LOG_ERROR, "Received non-video packet before "
+                                "header has been written\n");
+        return AVERROR_INVALIDDATA;
+    }
+
     if (!mxf->cbr_index && !mxf->edit_unit_byte_count && !(mxf->edit_units_count % EDIT_UNITS_PER_BODY)) {
         if ((err = av_reallocp_array(&mxf->index_entries, mxf->edit_units_count
                                      + EDIT_UNITS_PER_BODY, sizeof(*mxf->index_entries))) < 0) {
-- 
2.25.1