Opened 2 years ago

Closed 8 months ago

Last modified 8 months ago

#7993 closed defect (fixed)

null pointer passed as argument at libavformat/aviobuf.c:227

Reported by: Suhwan Owned by:
Priority: important Component: avformat
Version: git-master Keywords: mxf ubsan
Cc: Blocked By:
Blocking: Reproduced by developer: yes
Analyzed by developer: no

Description

Summary of the bug:
There's null pointer passed as argument at libavformat/aviobuf.c:227.

How to reproduce:

% ffmpeg_g  -y -i tmp.vob -map 0 -c:v prores_ks -c:v:122 fits -disposition:a:39 h261 -disposition:a:114 wmv1 -vframes 17 -b:v 587 -strict 1 tmp_.mxf

ffmpeg version : N-94163-g664a27ea40
built with clang version 9.0.0

Patches should be submitted to the ffmpeg-devel mailing list and not this bug tracker.

Attachments (2)

gdb_log_7993 (20.4 KB ) - added by Suhwan 2 years ago.
tmp.vob (604.0 KB ) - added by Suhwan 2 years ago.

Download all attachments as: .zip

Change History (6)

by Suhwan, 2 years ago

Attachment: gdb_log_7993 added

by Suhwan, 2 years ago

Attachment: tmp.vob added

comment:1 by Suhwan, 2 years ago

libavformat/aviobuf.c
maybe buf pointer is null.
memcpy(s->buf_ptr, buf, len);

 218 void avio_write(AVIOContext *s, const unsigned char *buf, int size)
 219 {
 220     if (s->direct && !s->update_checksum) {
 221         avio_flush(s);
 222         writeout(s, buf, size);
 223         return;
 224     }
 225     while (size > 0) {
 226         int len = FFMIN(s->buf_end - s->buf_ptr, size);
 227         memcpy(s->buf_ptr, buf, len);
 228         s->buf_ptr += len;
 229 
 230         if (s->buf_ptr >= s->buf_end)
 231             flush_buffer(s);
 232 
 233         buf += len;
 234         size -= len;
 235     }
 236 }

comment:2 by Elon Musk, 8 months ago

Component: undeterminedavformat
Keywords: avformat removed
Priority: normalimportant
Reproduced by developer: set
Status: newopen

comment:3 by mkver, 8 months ago

Resolution: fixed
Status: openclosed

comment:4 by Carl Eugen Hoyos, 8 months ago

Keywords: mxf added
Note: See TracTickets for help on using tickets.