[FFmpeg-devel] [PATCH 1/2] avformat/movenc: Fix segfault when remuxing rtp hint stream

Andreas Rheinhardt andreas.rheinhardt at gmail.com
Wed Sep 30 19:59:24 EEST 2020

When remuxing an rtp hint stream (or any stream with the tag "rtp "),
the mov muxer treats this as one of the rtp hint tracks it creates
internally when ordered to do so; yet this track lacks the
AVFormatContext for the hinting rtp muxer, leading to segfaults in
mov_write_udta_sdp() if a "trak" atom is written for this stream; if not,
the stream's codecpar is freed by mov_free() as if the mov muxer owned
it (it does for the internally created "rtp " tracks), but without
resetting st->codecpar, leading to double-frees lateron. This commit
therefore ignores said tag which makes rtp hint streams unremuxable.

This fixes tickets #8181 and #8186.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt at gmail.com>
This is the mov-equivalent of ticket #7079.

 libavformat/movenc.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/libavformat/movenc.c b/libavformat/movenc.c
index 265465f97b..7d89cd579a 100644
--- a/libavformat/movenc.c
+++ b/libavformat/movenc.c
@@ -1652,6 +1652,10 @@ static unsigned int mov_get_codec_tag(AVFormatContext *s, MOVTrack *track)
     unsigned int tag = track->par->codec_tag;
+    // "rtp " is used to distinguish internally created RTP-hint tracks
+    // (with rtp_ctx) from other tracks.
+    if (tag == MKTAG('r','t','p',' '))
+        tag = 0;
     if (!tag || (s->strict_std_compliance >= FF_COMPLIANCE_NORMAL &&
                  (track->par->codec_id == AV_CODEC_ID_DVVIDEO ||
                   track->par->codec_id == AV_CODEC_ID_RAWVIDEO ||

More information about the ffmpeg-devel mailing list