ffmpeg update to june 23 version which fixes mp4 crash on still frames with 3...

source/patched-ffmpeg-mt/libavformat/oma.c

Index: source/patched-ffmpeg-mt/libavformat/oma.c
===================================================================
--- source/patched-ffmpeg-mt/libavformat/oma.c	(revision 50820)
+++ source/patched-ffmpeg-mt/libavformat/oma.c	(working copy)
@@ -27,7 +27,8 @@
  *
  * Known file extensions: ".oma", "aa3"
  * The format of such files consists of three parts:
- * - "ea3" header carrying overall info and metadata.
+ * - "ea3" header carrying overall info and metadata. Except for starting with
+ *   "ea" instead of "ID", it's an ID3v2 header.
  * - "EA3" header is a Sony-specific header containing information about
  *   the OpenMG file: codec type (usually ATRAC, can also be MP3 or WMA),
  *   codec specific info (packet size, sample rate, channels and so on)
@@ -46,6 +47,7 @@
 #include "libavutil/intreadwrite.h"
 #include "raw.h"
 #include "riff.h"
+#include "id3v2.h"
 
 #define EA3_HEADER_SIZE 96
 
@@ -63,37 +65,22 @@
     { CODEC_ID_MP3,     OMA_CODECID_MP3 },
 };
 
+#define ID3v2_EA3_MAGIC "ea3"
+
 static int oma_read_header(AVFormatContext *s,
                            AVFormatParameters *ap)
 {
     static const uint16_t srate_tab[6] = {320,441,480,882,960,0};
-    int     ret, ea3_taglen, EA3_pos, framesize, jsflag, samplerate;
+    int     ret, framesize, jsflag, samplerate;
     uint32_t codec_params;
     int16_t eid;
     uint8_t buf[EA3_HEADER_SIZE];
     uint8_t *edata;
     AVStream *st;
 
-    ret = get_buffer(s->pb, buf, 10);
-    if (ret != 10)
-        return -1;
+    ff_id3v2_read(s, ID3v2_EA3_MAGIC);
+    ret = get_buffer(s->pb, buf, EA3_HEADER_SIZE);
 
-    if(!memcmp(buf, "ea3", 3)) {
-        ea3_taglen = ((buf[6] & 0x7f) << 21) | ((buf[7] & 0x7f) << 14) | ((buf[8] & 0x7f) << 7) | (buf[9] & 0x7f);
-
-        EA3_pos = ea3_taglen + 10;
-        if (buf[5] & 0x10)
-            EA3_pos += 10;
-
-        url_fseek(s->pb, EA3_pos, SEEK_SET);
-        ret = get_buffer(s->pb, buf, EA3_HEADER_SIZE);
-        if (ret != EA3_HEADER_SIZE)
-            return -1;
-    } else {
-        ret = get_buffer(s->pb, buf + 10, EA3_HEADER_SIZE - 10);
-        EA3_pos = 0;
-    }
-
     if (memcmp(buf, ((const uint8_t[]){'E', 'A', '3'}),3) || buf[4] != 0 || buf[5] != EA3_HEADER_SIZE) {
         av_log(s, AV_LOG_ERROR, "Couldn't find the EA3 header !\n");
         return -1;
@@ -163,7 +150,6 @@
     }
 
     st->codec->block_align = framesize;
-    url_fseek(s->pb, EA3_pos + EA3_HEADER_SIZE, SEEK_SET);
 
     return 0;
 }
@@ -182,9 +168,21 @@
 
 static int oma_read_probe(AVProbeData *p)
 {
-    if (!memcmp(p->buf, ((const uint8_t[]){'e', 'a', '3', 3, 0}), 5) ||
-        (!memcmp(p->buf, "EA3", 3) &&
-         !p->buf[4] && p->buf[5] == EA3_HEADER_SIZE))
+    const uint8_t *buf;
+    unsigned tag_len = 0;
+
+    buf = p->buf;
+    /* version must be 3 and flags byte zero */
+    if (ff_id3v2_match(buf, ID3v2_EA3_MAGIC) && buf[3] == 3 && !buf[4])
+        tag_len = ff_id3v2_tag_len(buf);
+
+    // This check cannot overflow as tag_len has at most 28 bits
+    if (p->buf_size < tag_len + 5)
+        return 0;
+
+    buf += tag_len;
+
+    if (!memcmp(buf, "EA3", 3) && !buf[4] && buf[5] == EA3_HEADER_SIZE)
         return AVPROBE_SCORE_MAX;
     else
         return 0;
@@ -203,5 +201,6 @@
     .flags= AVFMT_GENERIC_INDEX,
     .extensions = "oma,aa3",
     .codec_tag= (const AVCodecTag* const []){codec_oma_tags, 0},
+    .metadata_conv = ff_id3v2_metadata_conv,
 };