sysutils/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2026-10-24 02:09:03 +03:00
Code Activity

avformat/movenc: fix crash when flushing a fragment with no data

Browse Source 
mov_flush_fragment() calls ffio_reset_dyn_buf() on mov->mdat_buf when
writing the initial moov. That buffer is allocated lazily on the first
packet, so it is still NULL when the trailer is written before anything
was muxed, and ffio_reset_dyn_buf() dereferences it.

627da1111c replaced ffio_free_dyn_buf(), which tolerates NULL, with
ffio_reset_dyn_buf(), which does not, turning this case into a crash.

This affects every fragmented mode that defers the initial moov to the
first flush.

Skip the block entirely when the buffer was never opened. Nothing
references the empty mdat it would otherwise write, as no samples were
muxed.

Reproduced with:
ffmpeg -f lavfi -i color=s=64x64 -frames:v 0 -movflags +frag_keyframe out.mp4

Fixes: 627da1111c ("libavformat/movenc: Uses dynamic buffers for fragmented chunks")
Signed-off-by: Ackanir <git.ackanir@gmail.com>
This commit is contained in:
Ackanir
2026-08-17 14:36:53 +02:00
committed by michaelni
parent 78efc17cc5
commit 9f35e220ff
1 changed files with 7 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
libavformat/movenc.c
View File

@@ -6804,11 +6804,13 @@ static int mov_flush_fragment(AVFormatContext *s, int force)
return 0;
}
buf_size = avio_get_dyn_buf(mov->mdat_buf, &buf);
avio_wb32(s->pb, buf_size + 8);
ffio_wfourcc(s->pb, "mdat");
avio_write(s->pb, buf, buf_size);
ffio_reset_dyn_buf(mov->mdat_buf);
if (mov->mdat_buf) {
buf_size = avio_get_dyn_buf(mov->mdat_buf, &buf);
avio_wb32(s->pb, buf_size + 8);
ffio_wfourcc(s->pb, "mdat");
avio_write(s->pb, buf, buf_size);
ffio_reset_dyn_buf(mov->mdat_buf);
}
if (mov->flags & FF_MOV_FLAG_GLOBAL_SIDX)
mov->reserved_header_pos = avio_tell(s->pb);